Quick answers
- Is CVE-2026-83304 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-83304 being exploited in the wild.
- How severe is CVE-2026-83304?
- High severity, with a CVSS score of 8.9, published 15 September 2026.
- Which products and versions are affected?
- Oracle Business Intelligence Enterprise Edition 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0.
- Is there a fix for CVE-2026-83304?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-83304 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-83304?
- Check whether you run Oracle Business Intelligence Enterprise Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a difficult-to-exploit vulnerability in Oracle Business Intelligence Enterprise Edition's Analytics Web General component that allows unauthenticated network-based attackers to bypass security controls via HTTP. The vulnerability affects versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0, and has a scope change meaning impacts extend beyond the directly affected component. Successful exploitation results in unauthorized creation, deletion, and modification of critical data; complete unauthorized access to all accessible Business Intelligence data; and partial denial of service. The CVSS 3.1 score is 8.9 (High), with a vector of AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L, indicating network accessibility but high attack complexity. No patch availability information is currently available.
Affected products
- Oracle Business Intelligence Enterprise Edition 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0
Timeline
- 2026-09-15: disclosed