CVE-2026-83269
CRITICAL · 9.8Real CRITICAL vuln, fresh NVD listing, but no KEV, no PoC, no patch signal yet.
What: Unauthenticated remote code execution in Oracle BI Publisher (versions 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0) via HTTP; CVSS 9.8 CRITICAL allows full system takeover.
Why it matters: Fresh CRITICAL-rated Oracle vulnerability published yesterday with network-accessible, unauthenticated attack vector. No KEV-listing yet, but NVD description indicates complete compromise possible. Oracle customers running affected versions face immediate triage urgency. Vendor patch timeline unknown from current chatter.
Where it's seen: Early social amplification (Bluesky posts) restating NVD details with alarm emoji; no PoC observed, no vendor advisory linked, no defender incident reports yet. Appears to be initial disclosure wave without confirmed active exploitation.
RISK: CRITICAL — Unauthenticated RCE with 9.8 CVSS, zero authentication required, multiple versions affected.
Description
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High