CVE-2026-83320: 
Oracle Analytics Publisher vulnerability analysis and mitigation

CVE-2026-83320 is an authorization bypass vulnerability in the Administration component of Oracle BI Publisher, part of the Oracle Analytics product family. It affects versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The vulnerability was disclosed and patched on September 15, 2026, as part of Oracle's Critical Security Patch Update (CSPU). It carries a CVSS v3.1 base score of 7.6 (High) (Oracle Advisory).

The vulnerability is classified as an authorization bypass (CWE not explicitly specified, but characterized as an authorization bypass by Feedly threat intelligence). It is exploitable by a low-privileged attacker over HTTP with network access, but requires human interaction from a person other than the attacker — consistent with a cross-site request forgery (CSRF) or social engineering-assisted attack pattern. The vulnerability has a changed scope, meaning successful exploitation can impact products or resources beyond Oracle BI Publisher itself. No public proof-of-concept or detailed technical write-up has been published (Oracle Advisory).

Successful exploitation allows a low-privileged attacker to gain unauthorized read access to all data accessible by Oracle BI Publisher, including potentially critical or sensitive business intelligence data, as well as unauthorized insert, update, or delete access to some of that data. The changed scope indicates that the impact may extend to additional products integrated with or dependent on Oracle BI Publisher. Availability is not impacted by this vulnerability (Oracle Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is rated as "easily exploitable" by Oracle, requiring only low privileges and network access via HTTP, though human interaction is a prerequisite. The EPSS score is approximately 0.284%, indicating a low probability of exploitation in the near term. No threat actor attribution or CISA KEV catalog listing has been identified (Oracle Advisory).

Oracle has released a security patch for CVE-2026-83320 as part of the September 2026 Critical Security Patch Update, available for Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. Oracle strongly recommends applying the patch as soon as possible. As interim mitigations, organizations should restrict network access to Oracle BI Publisher to trusted users and networks, implement multi-factor authentication for accounts with access to the platform, and train users to recognize social engineering attempts that could be used to trigger the required human interaction. Additional authorization controls limiting data access for low-privileged users may also reduce risk (Oracle Advisory).

The vulnerability was noted in the AusCERT security bulletin ASB-2026.0235, indicating awareness within the Australian cybersecurity community. No significant independent researcher commentary, social media discussion, or broader media coverage has been identified beyond the Oracle advisory and aggregator bulletins (Oracle Advisory).