CVE-2026-83287 is a vulnerability in the Oracle Business Intelligence Enterprise Edition product, specifically in the Presentation Services component. It affects versions 8.2.0.0.0, 12.2.1.4.0, and 26.1.0.0.0. The flaw allows a low privileged attacker with network access via SOAP to compromise the system, potentially leading to unauthorized access to critical or all accessible data within Oracle Business Intelligence Enterprise Edition. The vulnerability has a CVSS 3.1 base score of 7.7, with the vector indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update, which contains 673 security patches across multiple products.

Successful exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all data accessible through Oracle Business Intelligence Enterprise Edition. The confidentiality impact is high, but there is no impact on integrity or availability. The vulnerability also has scope change, meaning it may affect additional products beyond Oracle Business Intelligence Enterprise Edition.

Oracle has released security patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are indicated in the advisory.