A vulnerability (CVE-2026-83289) exists in Oracle Business Intelligence Enterprise Edition (component: Analytics Web General) affecting versions 8.2.0.0.0, 12.2.1.4.0, and 26.1.0.0.0. It allows a low privileged attacker with network access via SOAP to potentially take over the product. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has released a Critical Security Patch Update (CSPU) in September 2026 addressing this and many other vulnerabilities. Oracle strongly recommends applying the available patches promptly to mitigate this risk.