CVE-2026-83319 is a vulnerability in the Oracle BI Publisher product of Oracle Analytics, specifically in the Web Service API component. It affects version 12.2.1.4.0 and allows a low-privileged attacker with network access via SOAP to compromise Oracle BI Publisher. The vulnerability impacts confidentiality, potentially granting unauthorized access to critical or all accessible data within Oracle BI Publisher. The CVSS 3.1 base score is 7.7 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted security fixes for this and other vulnerabilities across multiple Oracle products.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data or complete access to all data accessible by Oracle BI Publisher. The confidentiality impact is high, while integrity and availability impacts are not affected. The vulnerability may also affect additional Oracle products due to scope change.

Oracle has released a fix for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle BI Publisher version 12.2.1.4.0 should apply the relevant patches promptly to mitigate this vulnerability. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay. No additional mitigation steps are specified beyond applying the official patch.