CVE-2026-83309 is a vulnerability in the Oracle BI Publisher web server component that allows a low privileged attacker with network access via HTTP to compromise the system. The vulnerability enables unauthorized access to critical data and unauthorized modification (update, insert, delete) of some data accessible through Oracle BI Publisher. The vulnerability affects Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches across multiple products including Oracle BI Publisher.

Successful exploitation of this vulnerability can result in unauthorized access to critical data within Oracle BI Publisher and unauthorized update, insert, or delete operations on some of the accessible data. The vulnerability impacts confidentiality and integrity but does not affect availability. The scope of the vulnerability extends beyond Oracle BI Publisher, potentially impacting additional Oracle products. The CVSS score of 8.5 indicates a high severity level.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 without delay. Oracle strongly recommends remaining on actively-supported versions and promptly applying security patches to prevent exploitation. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html.