Quick answers
- Is CVE-2026-83303 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-83303 being exploited in the wild.
- How severe is CVE-2026-83303?
- High severity, with a CVSS score of 8.5, published 15 September 2026.
- Which products and versions are affected?
- Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0.
- Is there a fix for CVE-2026-83303?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-83303 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-83303?
- Check whether you run Oracle BI Publisher at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is in the BI Platform Security component of Oracle BI Publisher and allows a low-privileged attacker to perform unauthorized actions via SOAP protocol without requiring additional user interaction. The attack requires network access and low-level privileges but enables high-impact unauthorized modification and deletion of critical data, as well as unauthorized read access to sensitive information. While the vulnerability resides in BI Publisher, successful exploitation can impact additional Oracle products due to a scope change. Fixes are available in supported versions; affected versions include 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0.
Affected products
- Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0
Timeline
- 2026-09-15: disclosed