CVE-2026-83314 describes a vulnerability in the Oracle BI Publisher product of Oracle Analytics, specifically in the Web Service API component. The flaw allows a low privileged attacker with network access via SOAP to compromise Oracle BI Publisher by unauthorized creation, deletion, or modification of critical or accessible data, and to cause a hang or repeated crash resulting in denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H with a base score of 8.1. Affected versions explicitly stated are 8.2.0.0.0, 12.2.1.4.0, and 26.1.0.0.0. Oracle has included fixes for this vulnerability in its September 2026 Critical Security Patch Update, strongly recommending patch application.

Successful exploitation can lead to unauthorized modification or deletion of critical data within Oracle BI Publisher and cause denial of service by hanging or crashing the service. The vulnerability does not impact confidentiality but severely affects integrity and availability, potentially disrupting business operations relying on Oracle BI Publisher.

Oracle has released official security patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers should apply these patches promptly to remediate the vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No additional mitigation steps are indicated beyond patching.