Oracle Business Intelligence CVE-2026-83291

Exploitation requires that the attacker already be able to log on to the infrastructure where Oracle Business Intelligence Enterprise Edition executes - i.e., a valid low-privileged account with local access to the host (interactive shell, service account, or code execution as a non-privileged OS user), as stated by Oracle and encoded in CVSS AV:L/PR:L. The vulnerable component is specifically the Platform Security component of OBIEE versions 8.2.0.0.0 and 26.01.0.0.0. Limiting factors: it is not reachable over the network (AV:L), so external attackers cannot trigger it directly against the BI web tier; no user interaction is needed (UI:N), so a victim does not have to click or approve anything; and there is no scope change (S:U), so impact is confined to the OBIEE deployment itself rather than propagating to other systems. Versions outside the two listed releases, and deployments where no untrusted principal can obtain logon to the BI host, are not exposed by this vector.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8) describes a low-complexity, no-user-interaction escalation that yields total loss of confidentiality, integrity and availability on the affected system, but its attack vector is local and requires low privileges (PR:L) - so it is not remotely exploitable by an unauthenticated network attacker. The SSVC-style reading is: exploitation status unknown/not confirmed, automatable no (no public exploit, local precondition), technical impact total. Oracle's advisory confirms the flaw and the affected versions, but no EPSS probability, KEV listing or POC reference was provided, meaning the real-world exploitation signal is absent rather than negative - this should be treated as an unconfirmed-likelihood issue rather than an actively exploited one. Net assessment: a genuine post-compromise escalation risk on OBIEE hosts that should be patched in the normal CPU cycle, but it is significantly lower urgency than an equivalent 7.8 with AV:N/PR:N because an adversary must first obtain a low-privileged logon to the BI infrastructure. Note that the accompanying tag 'Information Disclosure' is inconsistent with a takeover-class vulnerability and appears to be a labeling error.

An attacker who has obtained a low-privileged foothold on the OBIEE host - for example a compromised service account, a contractor login, or a webshell running as a non-privileged OS user - invokes the Platform Security component's interface to elevate to full control of the BI installation. Because no user interaction is required (UI:N) and the attack is low complexity (AC:L), the escalation itself is straightforward once local access exists, allowing the attacker to read and tamper with BI reports, data sources and platform configuration and to persist inside the analytics stack. No public exploit code was identified at time of analysis, so this currently reflects a realistic post-compromise escalation path rather than a widely available weaponized exploit.