CVE-2026-83320 is a vulnerability in the Administration component of Oracle BI Publisher within Oracle Analytics. It affects supported versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The flaw allows a low privileged attacker with network access via HTTP to exploit the vulnerability with required user interaction from a third party. Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible by Oracle BI Publisher, as well as unauthorized update, insert, or delete operations on some data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, scope change, high confidentiality impact, low integrity impact, and no availability impact.

The vulnerability can lead to unauthorized access to critical data or full access to all data accessible by Oracle BI Publisher. Additionally, it allows unauthorized modification (update, insert, delete) of some data. The scope of impact extends beyond Oracle BI Publisher to other products due to the scope change. This can compromise confidentiality and integrity of sensitive information.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to affected versions 8.2.0.0.0, 12.2.1.4.0, and 26.1.0.0.0 of Oracle BI Publisher. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory indicating official fixes are available.