What is the CVSS score of CVE-2026-83321?

CVE-2026-83321 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N.

Oracle CVE-2026-83321

EUVD-2026-79674 HIGH

2026-09-15 secalert_us@oracle.com

GHSA-4r5x-x993-p7cp

Authentication Bypass Oracle

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 21:17 vuln.today

CVE Published

Sep 15, 2026 - 20:18 nvd

HIGH 8.5

DescriptionNVD

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Actions). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).

AnalysisAI

Oracle Business Intelligence Enterprise Edition (BI EE) versions 8.2.0.0.0 and 26.01.0.0.0 contain an easily exploitable flaw in the Analytics Actions component that lets a low-privileged, HTTP-reachable user read critical data and tamper with a subset of stored data, with the impact extending beyond the BI EE instance itself (CVSS scope change). Oracle rates it 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), and the vulnerability is addressed in the April 2026 Critical Security Patch Update. …