CVE-2026-83283
CRITICAL · 9.8Fresh CVE, high CVSS, no PoC/KEV yet; real threat but exploitation status unclear.
What: Unauthenticated remote code execution in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 via HTTP; CVSS 9.8 CRITICAL allows network attackers to fully compromise the application without authentication.
Why it matters: Published yesterday with maximum CVSS score and zero authentication requirement—textbook high-risk profile. Not yet KEV-listed and no public PoC confirmed in social chatter, but Oracle typically patches critical auth-bypass flaws within weeks. Early-stage detector interest suggests practitioners are monitoring for exploitation attempts.
Where it's seen: Bluesky posts amplifying NVD data; engagement driven by severity score and "unauthenticated" language rather than confirmed active exploitation or working exploit code.
RISK: CRITICAL — Unauthenticated RCE, CVSS 9.8, trivial attack vector, full system compromise possible.
Description
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High