CVE-2026-83305

Executive Summary

CVE-2026-83305 is a critical (CVSS 8.6) unauthenticated remote vulnerability in Oracle BI Publisher, part of Oracle Analytics, affecting the BI Platform Security component across supported versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. A remote attacker with only network access via HTTP can exploit the flaw without credentials or user interaction, resulting in high-impact confidentiality loss (access to all critical BI Publisher-accessible data), low-integrity modification or deletion of data, and a partial denial of service. Given the exposed web tier and the lack of a public CVE-to-patch mapping, security teams should treat any internet-facing BI Publisher deployment as at immediate risk and prioritize inventory and compensating controls.

Technical Analysis

The NVD description classifies this as an "easily exploitable vulnerability" in the "BI Platform Security" component of Oracle BI Publisher, exploitable by an unauthenticated attacker whose only prerequisite is network reachability over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) confirms:

• Attack Vector: Network — the vulnerable surface is exposed over a network protocol (HTTP).
• Attack Complexity: Low — no special conditions such as race windows or target-specific knowledge are required, per Oracle/NVD scoring convention.
• Privileges Required: None — authentication can be bypassed or is unnecessary for the exploit path.
• User Interaction: None — the victim does not need to click or load a resource.
• Scope: Unchanged — impact is confined to the BI Publisher security context.
• Confidentiality: High — "unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data."
• Integrity: Low — "unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data."
• Availability: Low — "partial denial of service."

The "BI Platform Security" component designation, combined with PR:N and HTTP network attack vector, is most consistent with an authentication/authorization bypass in the BI Publisher platform's security layer (a class aligned with CWE-306, Missing Authentication for Critical Function, and related access-control weaknesses). However, the NVD description does not disclose the specific endpoint, parameter, function, or library involved. Per strict accuracy limits, no specific code-level path, function name, or request parameter can be asserted here. What can be stated reliably is the vulnerability CLASS: an unauthenticated, remotely reachable access-control/authentication flaw in the BI Platform Security layer that yields high data disclosure and partial write/DoS impact.

Oracle BI Publisher (formerly XML Publisher / BI Publisher) exposes a web application server typically fronted by an application server and commonly published on the internet for report delivery, dashboard access, and scheduled job administration. Because the flaw is reachable over HTTP with no authentication, the attack surface is the entire HTTP interface of the "BI Platform Security" component rather than a single authenticated administrative page.

Because no vendor patch mechanism, function, class, or path is named in the source data, this report deliberately avoids naming internal entry points (for example, no XMLP server paths, no servlet mappings, no parameter names are invented). Any adversary must perform reconnaissance against the live product to discover the exact reachable surface, which is consistent with an unpatched, undocumented-by-the-public vulnerability with no known PoC.

Exploitation Scenarios

Note: No public PoC, exploit code, or Nuclei template is available (PoC_STATUS: None). The following chain is inferred strictly at the vulnerability-class level from the CVSS vector and NVD description. It does not assert specific code paths, endpoints, or parameter names that are absent from the source data.

Step 1 — Reconnaissance and target identification. An adversary scans the internet for Oracle BI Publisher instances. Because network access via HTTP is sufficient, they identify candidate hosts through Shodan/Censys queries against BI Publisher's characteristic HTTP title/HTML markers and probe the exposed HTTP service for the product's stable fingerprint. The attacker only needs the base network endpoint of the BI Publisher web application.

Step 2 — Triggering the vulnerability. The vulnerability lies in the "BI Platform Security" component, which is reachable without authentication (PR:N, UI:N). The adversary sends crafted HTTP requests to the BI Publisher platform security interface. Because the class of flaw is an unauthenticated access-control/auth bypass, the attacker bypasses or entirely avoids authentication on the affected security function, reaching protected functionality without possessing credentials. No specific HTTP method, URL, or payload syntax can be stated because the NVD description does not specify them; the "crafted request" formulation reflects the Oracle/NVD convention for this class.

Step 3 — Execution / access at the vulnerability-class level. On successful exploitation, the attacker gains the privileges of the BI Platform Security component itself. This is not remote code execution per the vector (no RCE, Scope Unchanged) — the immediate result is unauthorized access to data and limited write ability exposed by that security layer. The attacker can use this to enumerate and extract the platform's accessible data (High confidentiality impact).

Step 4 — Post-exploitation impact. Consistent with C:H/I:L/A:L, the attacker can exfiltrate "critical data or complete access to all Oracle BI Publisher accessible data" (report definitions, data sources rendered through reports, platform configuration and metadata as exposed by the security component), perform limited "unauthorized update, insert or delete" operations on some BI Publisher-accessible data (Integrity: Low), and cause a "partial denial of service" of BI Publisher (Availability: Low). Because authentication is bypassed, the attacker may also be able to pivot toward connected downstream data sources that the platform's service account can reach, subject to those sources' own authorization controls (this pivot is a reasonable class-level inference, but no credential or trust detail is provided in the source data).

Given the absence of any patch evidence (Patch Confidence 0/4) and no proof of public exploitation, this remains a pre-disclosure or newly disclosed vulnerability. Adversaries would need to independently develop an exploit, meaning mass exploitation is not yet indicated; targeted or manual exploitation by capable actors is the more likely near-term scenario.

Impact Assessment

Business impact. Oracle BI Publisher often serves as the enterprise reporting/production layer, frequently integrating with ERP, CRM, HR, financial, and data-warehouse systems. Successful exploitation yields High confidentiality loss — the attacker can read critical data the platform can access — plus limited integrity and availability impacts. Because PR:N and UI:N, there are no compensating constraints from authentication or user awareness.

Blast radius. A single reachable BI Publisher instance exposes its entire accessible dataset to the unauthenticated attacker. Because the platform's service account commonly holds broad read access into connected systems (business databases, data sources, and similar repositories), the effective confidentiality blast radius can extend beyond the BI Publisher server itself, contingent on the permissions the deployment's service identity holds. The Availability impact is explicitly partial (A:L), so this is a degradation rather than a full outage; the Integrity impact is limited (I:L), meaning limited writes/deletes rather than full data destruction.

Exploitability. With AC:L and PR:N, exploitation requires minimal skill beyond developing a working payload; the missing ingredient is the public exploit, which is not available. No CISA KEV listing and no exploitation evidence currently indicate active campaigns, but the EPSS score is not yet published by FIRST.org and cannot be used as a risk signal.

Business framing: unauthorized disclosure of critical report data can result in regulatory obligations (data protection/breach notification), loss of competitive or customer information, and partial service disruption. Given the absence of a confirmed patch, pressure on compensating controls (network isolation, WAF, monitoring) is high until an official Oracle Critical Patch Update is confirmed available.

Detection Guidance

Sigma Rule

Detects anomalous unauthenticated HTTP access patterns against BI Publisher web tier, focused on authentication-bypass attempts where the request lacks session/auth artifacts but targets protected BI Publisher application paths. It is process/network-adjacent and, in most SOCs, will be implemented by shipping HTTP proxy or WAF logs into an EDR/SIEM via a log import pipeline; the rule below targets common web-tier log events.

title: Potential Oracle BI Publisher Unauthenticated Access Attempt (CVE-2026-83305)
id: 6b7c2f1e-9a4d-4f2a-8c11-3d5e6f7a8b90
status: experimental
description: Detects HTTP requests to Oracle BI Publisher application paths that lack authentication/session artifacts and may indicate attempts to exploit an unauthenticated access-control bypass in the BI Platform Security component. Class-level detection only; no public PoC is available.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-83305
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: oracle
detection:
  selection_paths:
    c-uri|contains:
      - "/xmlpserver"
      - "/bi-publisher"
      - "/analytics/bipublisher"
      - "/BI Publisher"
  selection_noauth:
    - cs-cookie|contains: "JSESSIONID"
    - cs-username|exists: false
  filter_health:
    c-uri|endswith:
      - "/favicon.ico"
      - "/robots.txt"
  condition: selection_paths and not selection_noauth and not filter_health
falsepositives:
  - Legitimate anonymous report publication endpoints
  - Health checks and monitoring probes
level: medium
tags:
  - attack.t1190
  - cve.2026-83305

Note: the path strings above reflect publicly known BI Publisher URL conventions and are illustrative matching anchors, not confirmed exploit endpoints for this CVE. Analysts should tune the path list to their own deployment before enabling in blocking mode.

YARA Rule

Class-level YARA rule to scan web/log artifacts (WAF, proxy, application logs) for signs of unauthenticated exploitation attempts and related reconnaissance against BI Publisher. It matches on textual attack indicators, not on confirmed exploit binaries (none are public).

rule CVE_2026_83305_BI_Publisher_AuthBypass_Attempts
{
    meta:
        author = "valtersit.com"
        description = "Detects potential exploitation attempts against Oracle BI Publisher CVE-2026-83305 (unauthenticated BI Platform Security access-control bypass). Class-level detection; no public PoC available."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-83305"
        date = "2026-01-01"
        severity = "high"

    strings:
        $p1 = "xmlpserver" nocase
        $p2 = "bi-publisher" nocase
        $p3 = "BI Platform Security" nocase
        $a1 = "GET /xmlpserver/" nocase
        $a2 = "POST /xmlpserver/" nocase
        $s1 = "JSESSIONID" nocase
        $s2 = "Authorization:" nocase

    condition:
        (uint16(0) == 0x2F2A or uint16(0) == 0x4745 or uint16(0) == 0x504F) and
        (any of ($p1, $p2) ) and
        any of ($a1, $a2)
}

Suricata IDS Rule

Network detection for unauthenticated HTTP requests to BI Publisher application paths. Because no confirmed exploit signature exists, this detects anomalous unauthenticated access to the product's web tier and should be tuned to the deployment's baseline.

alert http any any -> any any (msg:"CVE-2026-83305 Possible Oracle BI Publisher Unauthenticated Access (BI Platform Security)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/xmlpserver"; nocase; http.cookie; content:"JSESSIONID"; nocase; negate; reference:cve,2026-83305; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-83305; classtype:attempted-user; sid:202683305; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, confidence low;)

Elastic Detection

EQL detection over web/proxy or WAF logs, flagging unauthenticated requests to BI Publisher application paths from external source IPs.

sequence by source.ip with maxspan=1m
  [ network where event.category == "network" and
      http.request.method in ("GET","POST") and
      http.url : "*xmlpserver*" and
      not c_user.name : "*" ]

Splunk SPL Query

Splunk search over web/WAF index for unauthenticated access attempts to BI Publisher paths followed by unusually high response sizes (possible data exfiltration indicator).

index=web OR index=proxy
| eval uri=lower(coalesce(uri, url, cs_uri_stem, ""))
| where match(uri, "xmlpserver|bi-publisher|analytics/bipublisher")
| eval has_auth=if(isnotnull(cookie) OR isnotnull(cs_username) OR isnotnull(authorization), 1, 0)
| where has_auth=0
| stats count min(_time) as first_seen max(_time) as last_seen sum(bytes) as total_bytes
        values(status) as status_codes
        by src_ip, uri
| where count >= 5 OR total_bytes > 500000
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"),
       last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - total_bytes

Wazuh OSSEC Rule

Wazuh rule set to detect unauthenticated access to BI Publisher paths in web logs. Uses parent rule 31100 (web accesslog) context.

<group name="web,accesslog,oracle,cve-2026-83305,">
  <rule id="100783" level="10">
    <if_sid>31100</if_sid>
    <id>^31</id>
    <description>Possible Oracle BI Publisher unauthenticated access attempt (CVE-2026-83305)</description>
    <match>xmlpserver|bi-publisher|BI Publisher</match>
    <regex>GET|POST</regex>
    <group>attack.access, pci_dss_10.2.4, nist_800_53_AU.6,</group>
  </rule>

  <rule id="100784" level="12">
    <if_sid>100783</if_sid>
    <description>Oracle BI Publisher unauthenticated request without session (CVE-2026-83305) - possible exploitation</description>
    <field name="url">xmlpserver|bi-publisher</field>
    <regex>^$</regex>
    <group>attack.access, attack.t1190, cve.2026-83305,</group>
  </rule>
</group>

Note: tune the match list to the actual BI Publisher URL scheme in your environment; the above uses publicly common BI Publisher URL markers as anchors and does not assert confirmed exploit endpoints for this CVE.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source; no vendor fix, workaround, or affected-version advisories were provided in the source data). Treat the following as compensating controls only, not as a vendor-confirmed fix.

1. Immediate mitigations (apply now):

• Remove internet exposure. Block or restrict HTTP/HTTPS access to BI Publisher from untrusted networks. Place it behind VPN, zero-trust proxy, or internal-only load balancers if the business can tolerate it.
• Network segmentation and allow-listing. Limit reachability of the BI Publisher web tier to known client subnets and reverse proxies.
• WAF/virtual patching. Deploy virtual patching at the WAF to block unauthenticated requests to BI Platform Security functions. Because the exact endpoint is not publicly specified, base rules on the product's authentication baseline (reject anonymous requests outside genuinely public report URLs) and tighten response.
• Monitoring-first posture. Enable the detection content in the previous section in alert mode and review for any anonymous access to protected BI Publisher surfaces.
• Rotate secrets as a precaution. Rotate application/service credentials and configurations that flow through the BI Publisher platform, in case of undetected pre-disclosure access.
• Inventory and exposure mapping. Enumerate all BI Publisher instances (8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0) and confirm which are internet-reachable, prioritizing those.

2. Patch/upgrade steps:

• No patch evidence is available from tracked sources for this CVE. Verify directly against Oracle's official advisory and the next Oracle Critical Patch Update (CPU)/Security Alert before assuming availability. Do not deploy unverified "patches" or third-party fixes.
• When Oracle publishes a fixed build for the affected version lines, stage and test in a non-production environment, then upgrade. Track the CPU cycle and subscribe to Oracle Security Alerts (see References).
• Until an official fix is confirmed, treat patching as pending and rely on the compensating controls above.

3. Long-term hardening:

• Enforce defense in depth: authentication at the reverse proxy layer (e.g., an SSO/IAM gateway) in front of BI Publisher so that even if the platform's own security component is bypassed, anonymous access to the app is blocked.
• Apply least privilege to BI Publisher's service accounts and any downstream data sources to limit blast radius (High confidentiality impact means data access is the primary risk).
• Regular patch management and configuration review aligned to Oracle CPU cadence.
• Continuous exposure monitoring with Shodan/Censys/ASM tooling to spot newly internet-exposed BI Publisher instances.
• Baseline normal access patterns to improve the signal of the detection queries in this report.

References

• NVD — CVE-2026-83305: https://nvd.nist.gov/vuln/detail/CVE-2026-83305
• Oracle Critical Patch Updates and Security Alerts (check for fixed versions in affected lines 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0): https://www.oracle.com/security-alerts/
• Oracle BI Publisher product documentation and security guidance: https://docs.oracle.com/en/middleware/bi-publisher/
• CISA Known Exploited Vulnerabilities Catalog (verify whether CVE-2026-83305 is later added): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (score not yet available at time of writing; monitor for publication): https://www.first.org/epss/

Threat actor / in-the-wild status: No CISA KEV listing, no public PoC ("PoC_STATUS: None"), no Nuclei template, and no exploit code were identified for CVE-2026-83305 in the provided data. There is no evidence of active exploitation campaigns at this time. Because the vulnerability is unauthenticated and network-reachable, defenders should monitor for emergence of exploit code and watch for the EPSS score once published by FIRST.org.