## Summary
CVE-2026-83282 is a high-severity vulnerability in Oracle Business Intelligence Enterprise Edition (Oracle Analytics), affecting 12.2.1.4.0 (component: Platform Security). It is described as easily exploitable by a low-privileged attacker with network access via HTTP, potentially leading to full takeover.
## Technical Details
- Affected component: Platform Security within Oracle Business Intelligence Enterprise Edition.
- Attack vector: NETWORK via HTTP.
- Preconditions: attacker has network access over HTTP and low privileges (PR:L, UI:N).
- Likely outcome of successful exploitation: compromise/takeover of the Oracle Business Intelligence Enterprise Edition instance.
- Impact scope: the NVD notes potential scope change, where compromise may significantly impact additional products.
## Affected
- Oracle Business Intelligence Enterprise Edition (Oracle Analytics)
- Version: 12.2.1.4.0
## Impact
- CVSS 3.1 base score: 9.9 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
- Confidentiality impact: H (high)
- Integrity impact: H (high)
- Availability impact: H (high)
- Overall: takeover/compromise of the affected product.
## Mitigation
1. Apply the vendor’s security patch/fix for Oracle Business Intelligence Enterprise Edition version 12.2.1.4.0 as soon as available.
2. Restrict HTTP access to the Oracle BI environment to only trusted networks/clients (reduce AV:N exposure).
3. Monitor for suspicious activity consistent with unauthorized access attempts and abnormal behavior following HTTP requests.
4. Validate that compensating controls (network segmentation, firewall rules, and access control) are in place for low-privilege accounts (PR:L).
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H