CVE-2026-83304 is a network-accessible vulnerability in Oracle Business Intelligence Enterprise Edition's Analytics Web General component. It allows an unauthenticated attacker to perform unauthorized actions including creation, deletion, or modification of critical data, and gain unauthorized access to all accessible data. The vulnerability also enables the attacker to cause a partial denial of service. The CVSS 3.1 vector indicates network attack vector with high attack complexity, no privileges required, no user interaction, and scope change, resulting in high confidentiality and integrity impact and low availability impact. Affected versions explicitly include 8.2.0.0.0, 12.2.1.4.0, and 26.1.0.0.0. Oracle's September 2026 Critical Security Patch Update includes patches for this vulnerability.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Business Intelligence Enterprise Edition, unauthorized access to all accessible data, and partial denial of service. The vulnerability affects confidentiality, integrity, and availability, with the highest impact on confidentiality and integrity. The vulnerability is difficult to exploit but does not require authentication or user interaction.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are indicated in the advisory.