CVE-2026-83336 is a vulnerability in Oracle Business Intelligence Enterprise Edition's Analytics Server component affecting versions 8.2.0.0.0 and 26.01.0.0.0. The flaw allows an attacker with low privileges and logon access to the underlying infrastructure to compromise the Oracle Business Intelligence Enterprise Edition product, potentially leading to full takeover. The vulnerability has a CVSS 3.1 score of 7.8, reflecting high impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes patches addressing this vulnerability among 673 others across multiple Oracle products.

Successful exploitation of this vulnerability can result in complete compromise of Oracle Business Intelligence Enterprise Edition, affecting confidentiality, integrity, and availability of the system. The attacker requires only low privileges and logon access to the infrastructure where the product runs. There are no known exploits in the wild at this time.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively-supported versions and applying security updates without delay. No alternative mitigations or workarounds are specified in the advisory.