Oracle Business Intelligence CVE-2026-83071

Preconditions: the attacker must already possess credentials that permit logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes (CVSS PR:L / AV:L), and the affected versions must be 8.2.0.0.0 or 26.01.0.0.0 with the Machine Learning component present - a default component of the BI EE installation. No user interaction is required (UI:N) and no non-default configuration flag is documented in the description. Limiting factors: the attack cannot be launched remotely over the network, it cannot be performed by an anonymous user, and it does not cross a security scope boundary (S:U) - the compromised asset is the BI EE instance itself. It does not require administrative privileges beforehand, which is precisely why it is a privilege-escalation concern; organizations that already restrict host-level logon to a small trusted group reduce the exposed population to nearly zero.

The CVSS 3.1 base score of 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is internally consistent: exploitation is trivially automatable once host access exists, but it is gated behind a logon on the BI EE host with low privileges, which substantially reduces exposure compared with a network-vector flaw. No EPSS score, no KEV listing and no POC evidence were provided, so active exploitation is unconfirmed and cannot be assumed; the absence of EPSS/KEV data is a genuine gap rather than evidence of low risk. Real-world priority is highest for multi-tenant or shared-host deployments where many users can log on to the same server as the BI service, since any one of them could escalate to control of the whole analytics platform; for single-purpose, tightly restricted hosts the practical risk is materially lower. Oracle categorizes this under its Critical Security Patch Update, indicating vendor-side severity but not observed exploitation.

An attacker who already holds a low-privileged account on the server hosting Oracle Business Intelligence Enterprise Edition (for example a contractor, shared-hosting tenant or a compromised service account) logs on locally and interacts with the Machine Learning component. Because the flaw is low-complexity and needs no user interaction, the attacker escalates from that limited account to control of the BI EE platform itself, gaining read/write access to analytics data, model definitions and administrative functionality. No public exploit code is known to exist, so the technique would have to be developed by the attacker.