CVE-2026-83295

Executive Summary

CVE-2026-83295 is a difficult-to-exploit but high-impact vulnerability in Oracle Business Intelligence Enterprise Edition (BI EE), specifically within the Presentation Services component. It affects supported versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. A low-privileged attacker with network access via SOAP can exploit this flaw to achieve full takeover of the affected BI EE instance, resulting in complete loss of confidentiality, integrity, and availability. With a CVSS 3.1 base score of 7.5 and no public PoC or patch currently available, organizations running these versions should prioritize hardening and monitoring.

Technical Analysis

The vulnerability resides in the Presentation Services component of Oracle BI EE. The NVD description states that exploitation is possible via SOAP (Simple Object Access Protocol), which is a standard protocol used for exchanging structured information in web services. The attack requires network access (AV:N), low privileges (PR:L), and no user interaction (UI:N). The AC:H (High Attack Complexity) rating indicates that successful exploitation depends on conditions beyond the attacker's control—likely specific server configurations, timing, or state that must be met.

The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a scope-unchanged vulnerability that fully compromises confidentiality, integrity, and availability. While the exact code-level flaw is not detailed in the NVD description, the combination of SOAP as the attack vector and the Presentation Services component suggests a class of vulnerability involving insecure deserialization, XML external entity (XXE) injection, or SOAP-based authentication bypass leading to remote code execution. The CWE assigned by the vendor is CWE-502 (Deserialization of Untrusted Data), which aligns with the SOAP vector: SOAP messages are XML-based and may contain serialized objects that, if improperly handled by the Presentation Services layer, could be deserialized and executed.

The Presentation Services component in Oracle BI EE is responsible for rendering dashboards, reports, and interactive analytics. It typically exposes SOAP endpoints for integration with other enterprise systems. An attacker with low privileges—perhaps a valid but limited BI EE user—could craft a malicious SOAP request to a vulnerable endpoint, triggering deserialization of untrusted data. Because the vulnerability allows takeover of the entire BI EE instance, successful exploitation likely grants the attacker the ability to execute arbitrary code with the privileges of the BI EE service account, pivot to backend databases, and access sensitive business intelligence data.

Exploitation Scenarios

Given the absence of a public PoC and limited technical detail, the attack chain is inferred at the vulnerability-class level.

1. Reconnaissance/target identification: The attacker scans for internet-facing or internal Oracle BI EE instances. Shodan dorks such as http.title:"Oracle Business Intelligence" can identify exposed Presentation Services endpoints. The attacker may also enumerate SOAP endpoints, often exposed under paths like /analytics/saw.dll or /xmlpserver (note: these paths are commonly associated with Oracle BI, but the NVD description does not specify exact paths; they are mentioned here as likely targets based on product knowledge, not as confirmed vulnerable endpoints).

2. Triggering the flaw: The attacker, possessing low-privileged credentials (valid or compromised), sends a crafted SOAP request to a vulnerable Presentation Services web service. The request contains malicious serialized data or XML payload designed to exploit the deserialization or parsing weakness. The high attack complexity (AC:H) implies that the attacker may need to satisfy preconditions such as a specific service state, a particular SOAP action, or a specific version configuration.

3. Payload/execution method: At the vulnerability-class level, the payload likely leverages deserialization of untrusted data to execute arbitrary code. The attacker could embed a gadget chain within the SOAP message that, when deserialized by the Presentation Services component, executes system commands or loads a remote payload. Alternatively, if the flaw is XXE, the attacker could read files or perform SSRF, though the CVSS impact suggests full takeover rather than just information disclosure.

4. Post-exploitation impact: Successful exploitation results in complete compromise of the BI EE instance. The attacker can exfiltrate sensitive business intelligence data, modify reports and dashboards (integrity impact), and disrupt availability. The attacker could also use the compromised BI EE server as a pivot point to access backend databases and other internal systems.

No public PoC is available; the attack chain is inferred from the vulnerability class and the SOAP vector described in the NVD.

Impact Assessment

The CVSS 3.1 base score of 7.5 reflects high impact across confidentiality, integrity, and availability, but with high attack complexity and low privileges required. The scope is unchanged, meaning the vulnerable component (BI EE) and the impacted component are the same. Business impact includes:

• Data breach: BI EE often aggregates sensitive financial, operational, and customer data. Full confidentiality impact means all data accessible via BI EE may be exposed.
• Integrity loss: Attackers can alter reports, dashboards, and underlying data, leading to erroneous business decisions.
• Availability loss: The service can be disrupted or taken offline, affecting critical business analytics.
• Blast radius: The compromised BI EE instance can serve as a foothold to access backend databases (e.g., Oracle Database), other integrated applications, and the underlying operating system. The blast radius extends to any system that trusts the BI EE instance for authentication or data.

Exploitation requires low privileges, meaning an attacker who has obtained even a basic user account (e.g., through phishing or credential stuffing) can escalate to full control. The high attack complexity may limit mass exploitation, but a determined attacker with inside knowledge or sufficient time can succeed.

Detection Guidance

Sigma Rule

title: Suspicious SOAP Requests to Oracle BI EE Presentation Services
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2026-83295 via malicious SOAP requests targeting Oracle BI EE Presentation Services.
author: valtersit.com
date: 2026-05-17
logsource:
  category: webserver
  product: oracle_bi
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem|contains: '/analytics/'
    cs-uri-query|contains: 'SOAPAction'
    cs-headers|contains: 'text/xml'
  condition: selection
falsepositives:
  - Legitimate SOAP integration traffic
level: high
tags:
  - attack.t1190
  - cve.2026.83295

YARA Rule

rule CVE_2026_83295_Oracle_BI_SOAP_Exploit
{
    meta:
        description = "Detects SOAP payloads targeting Oracle BI EE Presentation Services (CVE-2026-83295)"
        author = "valtersit.com"
        date = "2026-05-17"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-83295"
        cve = "CVE-2026-83295"
    strings:
        $soap = "SOAPAction" ascii wide nocase
        $bi = "Presentation Services" ascii wide nocase
        $deserial = "java.io.ObjectInputStream" ascii wide nocase
        $exec = "Runtime.getRuntime().exec" ascii wide nocase
    condition:
        any of ($soap, $bi) and any of ($deserial, $exec)
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-83295 Oracle BI EE Presentation Services SOAP Exploit Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/analytics/"; http_uri; content:"SOAPAction"; http_header; content:"text/xml"; http_header; pcre:"/java\.io\.ObjectInputStream|Runtime\.getRuntime\(\)\.exec/Ui"; classtype:attempted-admin; sid:10000001; rev:1; reference:cve,2026-83295; metadata:created_at 2026_05_17, updated_at 2026_05_17;)

Elastic Detection

sequence by host.id with maxspan=5s
  [network where network.protocol == "http" and http.request.method == "POST" and
   url.path : "/analytics/*" and http.request.headers contains "SOAPAction"]
  [file where file.path : "*/java.io.ObjectInputStream*" or process.args : "*Runtime.getRuntime().exec*"]

Splunk SPL Query

index=web sourcetype=access_combined
| search method=POST uri_path="/analytics/*" 
| search (uri_query="*SOAPAction*" OR http_user_agent="*SOAP*")
| rex field=uri_query "SOAPAction=(?<soap_action>[^&]+)"
| where like(soap_action, "%java.io.ObjectInputStream%") OR like(soap_action, "%Runtime.getRuntime().exec%")
| stats count by src_ip, uri_path, soap_action
| where count > 5

Wazuh OSSEC Rule

<group name="oracle_bi,web,">
  <rule id="100100" level="12">
    <if_sid>31100</if_sid>
    <field name="url">/analytics/</field>
    <field name="method">POST</field>
    <field name="headers">SOAPAction</field>
    <description>CVE-2026-83295: Potential Oracle BI EE SOAP exploitation attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict network access to Oracle BI EE SOAP endpoints. Only allow trusted IPs to reach the Presentation Services component.
   • If SOAP is not required, disable or block SOAP endpoints at the web server or reverse proxy level.
   • Enforce strong authentication and least privilege for BI EE accounts. Avoid granting unnecessary privileges to low-privileged users.
   • Deploy WAF rules to inspect SOAP requests for malicious deserialization payloads (e.g., java.io.ObjectInputStream, Runtime.getRuntime().exec).
   • Monitor logs for unusual SOAP POST requests to /analytics/ paths.

2. Patch/upgrade steps:

   • No official patch is available as of this report. Monitor Oracle Critical Patch Updates (CPU) for a fix. Once released, apply the patch immediately.
   • Subscribe to Oracle Security Alerts for CVE-2026-83295.

3. Long-term hardening:

   • Implement network segmentation to isolate BI EE from untrusted networks.
   • Use application-layer firewalls to validate SOAP message structure and reject unexpected serialized objects.
   • Regularly review and remove unused SOAP services or endpoints.
   • Conduct security assessments and penetration tests focused on deserialization and SOAP-based attacks.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83295
• Oracle Critical Patch Updates: https://www.oracle.com/security-alerts/
• CWE-502: https://cwe.mitre.org/data/definitions/502.html
• Oracle BI EE Security Guide: https://docs.oracle.com/en/middleware/bi/enterprise-edition/
• CISA KEV: Not applicable (CVE not listed in KEV as of this report).

No known threat actor campaigns or exploit-in-the-wild evidence have been observed for CVE-2026-83295 at the time of writing.