Oracle BI Publisher CVE-2026-83268

Exploitation requires the attacker to already hold high-privilege (administrative) access to the Oracle BI Publisher instance (PR:H), plus network access over HTTP to the BI Platform Security component; no user interaction is needed and default configurations are affected once that privilege level is held. The high-privilege prerequisite is the primary limiting factor, sharply reducing realistic risk from anonymous or low-privilege attackers. The scope change means a successful attack can extend impact beyond BI Publisher to additional integrated products. Affected versions are 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0.

The CVSS 3.1 base score is 9.1 (Critical) with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, and the score is well-calibrated: the network vector, low complexity, no user interaction, full C/I/A impact, and scope change (S:C) would push this toward 10.0, but the honest PR:H (high privileges required) metric correctly holds it at 9.1. This is the key risk limiter - an attacker must already hold high-privilege (administrative) access to BI Publisher before exploiting, which sharply narrows the practical threat versus a pre-auth flaw. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. SSVC-style read: technical impact is Total (full takeover with scope change onto additional products), but automatability is limited by the high-privilege prerequisite. Net: this is a genuinely serious flaw where it applies, but it is a lower operational priority than the pre-auth (PR:N) criticals in the same Oracle September 2026 CPU because the attacker must already be privileged. Missing data: Oracle's advisory (cspusep2026) provides zero technical detail, so the exact attack surface within 'BI Platform Security' and the nature of the scope-change impact on 'additional products' are unverified.

An attacker who has already obtained high-privilege (administrator-level) credentials on an Oracle BI Publisher instance sends crafted HTTP requests to the BI Platform Security component. Because the flaw carries a scope change, successful exploitation can escalate beyond BI Publisher itself to compromise additional integrated Oracle products, resulting in full takeover. No public proof-of-concept exists at time of analysis, and exploitation requires pre-existing high privileges rather than anonymous access.