CVE-2026-83294 is a vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics, specifically in the Platform Security component. It affects versions 8.2.0.0.0, 12.2.1.4.0, and 26.1.0.0.0. The flaw allows an unauthenticated attacker who has logon access to the underlying infrastructure to compromise the product, potentially leading to full takeover. Exploitation requires user interaction from a person other than the attacker. The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 other patches.

The vulnerability can lead to complete compromise of Oracle Business Intelligence Enterprise Edition, affecting confidentiality, integrity, and availability of the system. An attacker with local access but no privileges can exploit this flaw if a user interacts with the attack vector. This could result in takeover of the affected product, potentially exposing sensitive analytics data and disrupting business operations.

Oracle has released a fix for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to affected versions 8.2.0.0.0, 12.2.1.4.0, and 26.1.0.0.0. Oracle recommends remaining on actively supported versions and applying security patches without delay. No additional mitigation steps are indicated beyond applying the official patches.