CVE-2026-83282
CRITICAL · 9.9Fresh CVE, no PoC/KEV/advisory yet; social signal is automated aggregation only.
What: Oracle Business Intelligence Enterprise Edition (v12.2.1.4.0) platform security flaw allowing low-privilege network attackers to achieve full compromise via HTTP; CVSS 9.9 CRITICAL with scope change.
Why it matters: Published yesterday with maximum CVSS score and low attack complexity, but not yet KEV-listed. No public PoC, vendor advisory, or confirmed exploitation reported. Early social amplification appears driven by automated feed scanning rather than active defense triage.
Where it's seen: Bluesky posts linking to third-party CVE aggregators; generic vulnerability notification cadence with no defender questions, exploit code, or patching guidance visible.
RISK: CRITICAL — CVSS 9.9, scope change, low privilege + network access = high blast radius if exploited.
Description
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High