by Kastro
Paper/Archive/CVE-2026-83268

CVE-2026-83268

Oracle Corporation Oracle BI Publisher — Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security).

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
35
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 40.1.401 × 208.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle BI Publisher. While the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

Affected

ProductAffectedFixed inSource
Oracle BI Publisher8.2.0.0.0–CNA
Oracle BI Publisher12.2.1.4.0–CNA
Oracle BI Publisher26.01.0.0.0–CNA

Scores by source

oracle (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisoryoracle.com/security-alerts/cspusep2026.html