CVE-2026-83319: 
Oracle Analytics Publisher vulnerability analysis and mitigation

CVE-2026-83319 is an authorization bypass vulnerability in the Web Service API component of Oracle BI Publisher, part of the Oracle Analytics product family. The affected version is 12.2.1.4.0. A low-privileged attacker with network access via SOAP can exploit this vulnerability to gain unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. The vulnerability has a CVSS v3.1 base score of 7.7 (High), with a scope change indicating potential impact on additional products beyond BI Publisher itself. It was disclosed and patched on September 15, 2026, as part of Oracle's Critical Security Patch Update (Oracle Advisory).

The vulnerability is classified as an authorization bypass (CWE not explicitly specified by Oracle) in the SOAP-based Web Service API of Oracle BI Publisher. An attacker with low privileges and network access can send crafted SOAP requests to the vulnerable API endpoint, bypassing access controls to read data they are not authorized to access. The scope change in the CVSS vector (S:C) indicates that successful exploitation can affect resources beyond the vulnerable component itself, potentially impacting other products or data stores accessible to BI Publisher. Oracle has not publicly disclosed detailed technical write-ups or proof-of-concept code for this vulnerability (Oracle Advisory).

Successful exploitation results in unauthorized access to critical data or complete access to all data accessible to Oracle BI Publisher, representing a high confidentiality impact. There is no integrity or availability impact based on the CVSS scoring. Because the scope is changed, attacks may significantly affect additional products beyond BI Publisher, increasing the potential for sensitive data exposure across interconnected Oracle Analytics environments (Oracle Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the disclosure date. The vulnerability is easily exploitable (low attack complexity, no user interaction required) by any low-privileged user with network access to the SOAP API. The EPSS score is approximately 0.0037 (0.37%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Oracle Advisory).

Oracle has released a patch for CVE-2026-83319 as part of the September 2026 Critical Security Patch Update, addressing Oracle BI Publisher version 12.2.1.4.0. Organizations should apply the patch immediately following Oracle's guidance in the Patch Availability Document for Oracle Analytics. As a temporary workaround, Oracle recommends restricting network access to the SOAP Web Service API to only authorized users and systems, and implementing network-level controls to limit exposure of the BI Publisher service. Reviewing and strengthening access controls for low-privileged accounts with SOAP access can further reduce risk until patching is complete (Oracle Advisory).

The vulnerability was noted in the AusCERT security bulletin ASB-2026.0235, which aggregated Oracle's September 2026 CSPU advisories for its constituents. No significant independent researcher commentary, social media discussion, or media coverage specific to CVE-2026-83319 has been identified beyond standard advisory republication (Oracle Advisory).