Description
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Published: 2026-09-15
Score: 7.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Access
Action: Immediate Patch
AI Analysis

Impact

A vulnerability in Oracle Business Intelligence Enterprise Edition’s Presentation Services allows a low‑privileged attacker with network access via SOAP to bypass authentication controls and obtain unauthorized access to critical data. The weakness is exploitable over the network, can be used by an attacker with limited privileges, and expands the scope to other Oracle products, creating a high‑confidentiality breach risk. The CVSS 3.1 vector shows network access, low attack complexity, low privileges, no user interaction, and a changed scope with high confidentiality impact.

Affected Systems

Oracle Business Intelligence Enterprise Edition, versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0.

Risk and Exploitability

The CVSS base score of 7.7 indicates significant severity while the EPSS score of less than 1% suggests a low probability of exploitation at the present time, and the vulnerability is not listed in the CISA KEV catalog. It can be exploited remotely via SOAP, requiring only low privileges and no user interaction, but the impact includes full data exposure for all accounts that can reach the affected service.

Generated by OpenCVE AI on September 22, 2026 at 20:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch that addresses CVE-2026-83287 or upgrade to a non‑affected version.
  • Limit inbound SOAP traffic by fire‑walling against untrusted hosts from the public network.
  • Configure strongly typed role‑based permissions on BI Enterprise Edition so that low‑privileged accounts cannot view sensitive data.
  • Enable detailed logging of SOAP requests and monitor for abnormal activity, responding to any indications of exploitation.

Generated by OpenCVE AI on September 22, 2026 at 20:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 24 Sep 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
Title Low-Privilege SOAP Exploit in Oracle BI Enterprise Edition

Tue, 22 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
Title Low-Privilege SOAP Exploit in Oracle BI Enterprise Edition
Weaknesses CWE-284

Tue, 22 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200

Sun, 20 Sep 2026 08:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Low‑Privilege SOAP Attack Allows Unauthorized Data Access in Oracle Business Intelligence Enterprise Edition
Weaknesses CWE-284

Wed, 16 Sep 2026 23:00:00 +0000

Type Values Removed Values Added
Title Low‑Privilege SOAP Attack Allows Unauthorized Data Access in Oracle Business Intelligence Enterprise Edition
Weaknesses CWE-284

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
First Time appeared Oracle
Oracle business Intelligence
CPEs cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:business_intelligence:26.01.0.0.0:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:business_intelligence:8.2.0.0.0:*:*:*:enterprise:*:*:*
Vendors & Products Oracle
Oracle business Intelligence
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Oracle Business Intelligence
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-22T14:52:01.601Z

Reserved: 2026-08-31T15:40:57.351Z

Link: CVE-2026-83287

cve-icon Vulnrichment

Updated: 2026-09-22T14:51:54.159Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:41.377

Modified: 2026-09-22T15:17:16.900

Link: CVE-2026-83287

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T20:30:08Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor