CVE-2026-83309 is a vulnerability in the Oracle BI Publisher product of Oracle Analytics, specifically in the Web Server component. It affects versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The flaw allows a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized access to critical data and unauthorized update, insert, or delete operations on accessible data. The vulnerability has a CVSS 3.1 base score of 8.5 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle's September 2026 Critical Security Patch Update includes patches for this vulnerability. Oracle strongly recommends applying these patches without delay to mitigate the risk.

Successful exploitation can lead to unauthorized access to critical data within Oracle BI Publisher and unauthorized modification (update, insert, delete) of some accessible data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope change indicates that the impact may extend beyond Oracle BI Publisher to additional Oracle products. The CVSS score of 8.5 reflects a high severity risk.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No additional mitigation steps are indicated beyond applying the official patches.