Oracle BI Publisher CVE-2026-83305

Exploitation requires network reachability to the Oracle BI Publisher HTTP listener and no credentials, user interaction, or non-default feature enablement per the CVSS vector (AV:N/AC:L/PR:N/UI:N) and Oracle's 'easily exploitable' wording; the flaw lives in the always-present BI Platform Security component, so no optional module must be switched on. Limiting factors are deployment-side rather than configuration-side: the instance must be exposed to the attacker's network path (internet-facing deployments carry the most risk, while instances restricted to a trusted management VLAN are effectively shielded by segmentation), the attacker obtains only what the BI Publisher service account can reach rather than host-level code execution, and integrity/availability impact is partial (I:L/A:L) so full data destruction is not demonstrated. No public exploit code, EPSS score, or KEV confirmation was provided, meaning no exploit exists in the supplied intelligence that a low-skill actor could reuse without independent research.

CVSS 8.6 with AV:N/AC:L/PR:N/UI:N describes an unauthenticated, low-complexity, network-reachable attack requiring no user interaction, and Oracle's own advisory language ('easily exploitable') corroborates that this is not a theoretical edge case - the SSVC-style read is exploitation: none known, automatable: yes, technical impact: partial (high confidentiality, limited integrity/availability). The critical caveat is that no EPSS score, no KEV entry, and no POC reference were provided, so active exploitation is unconfirmed and the practical risk is currently bounded by whether the instance is internet-facing or reachable from an untrusted network segment; internally segmented deployments face materially lower exposure. Note also that the supplied tags include 'Authentication Bypass' and 'Denial Of Service', which are consistent with the confidentiality-heavy impact profile but are not independently corroborated by Oracle's description text, and the absence of a CWE identifier means the precise root-cause class (e.g. missing authentication vs. improper access control) remains an inference, not a confirmed fact.

An unauthenticated attacker with HTTP reachability to a BI Publisher instance sends crafted requests to the BI Platform Security endpoints, bypassing authentication checks and obtaining the session or data access normally reserved for an authenticated report consumer. The attacker then enumerates and exfiltrates report definitions, data-source credentials, and the business data visible to the BI Publisher service account, and can additionally modify or delete some accessible records and trigger a partial denial of service against the reporting service. No public exploit code was identified at time of analysis, so a successful attack currently requires the adversary to develop the bypass technique themselves.