CVE-2026-91563 in Database Server
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle OLAP component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having DBMS_AW privilege with network access via Oracle Net to compromise Oracle OLAP. Successful attacks of this vulnerability can result in takeover of Oracle OLAP. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Oracle OLAP component of the Oracle Database Server ecosystem, specifically affecting supported versions ranging from 19.3 through 19.32, as well as releases in the 21.x and 23.x branches including 21.3-21.23 and 23.4.0-23.26.3. This security flaw represents a critical risk to organizations relying on Oracle Database for analytical processing workloads, as it directly compromises the integrity of one of the core database features designed for complex online analytical processing operations. The existence of this vulnerability in multiple major release lines indicates a systemic issue within the OLAP engine that requires immediate attention from database administrators and security teams responsible for maintaining these specific version clusters.
From a technical perspective, the flaw is characterized by an easily exploitable condition that allows low-privileged attackers to achieve significant unauthorized access. The attack vector specifically targets the DBMS_AW privilege set, which grants users control over Advanced Workspaces within Oracle OLAP. An attacker possessing this relatively common database role can leverage network connectivity via Oracle Net to trigger the vulnerability remotely without requiring user interaction or complex preconditions. This remote exploitability significantly lowers the barrier for entry compared to local-only vulnerabilities, enabling threat actors who have already gained a foothold in the network perimeter or through compromised low-level credentials to escalate their privileges effectively.
The operational impact of this vulnerability is severe, with a CVSS 3.1 Base Score of 8.8 indicating High severity. The attack results in a complete takeover of Oracle OLAP services, which translates into broad impacts across confidentiality, integrity, and availability as reflected by the vector string AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Confidentiality is compromised because an attacker can access sensitive analytical data stored within workspaces that may contain proprietary business intelligence or financial projections. Integrity is undermined as malicious actors can alter calculation scripts, metadata definitions, and aggregated results, leading to corrupted decision-making processes based on tainted analytics. Availability suffers since the compromise of OLAP services can disrupt reporting systems and dashboards dependent on real-time analytical queries, causing operational downtime for data-driven workflows.
This vulnerability aligns with CWE-269 Improper Privilege Management, as it exploits insufficient restrictions on a database role to perform actions beyond its intended scope. Furthermore, in the context of the MITRE ATT&CK framework, this behavior maps closely to T1078 Valid Accounts and potentially T1530 Data from Cloud Storage if OLAP data is synchronized with external repositories. The ability for low-privileged users to escalate privileges via network-accessible services highlights a failure in least privilege enforcement within the database configuration or code logic governing DBMS_AW procedures.
Mitigation strategies must focus on both immediate remediation and long-term hardening. Oracle has likely released patches addressing this specific flaw, so applying the latest security updates for all affected versions is the primary corrective action. In environments where patching cannot be immediately implemented due to operational constraints, network segmentation should be enforced to restrict access to Oracle Net ports from untrusted networks or low-privileged user segments. Additionally, database administrators should audit and minimize the assignment of DBMS_AW privileges to only those users who strictly require them for their job functions, thereby reducing the attack surface available to potential intruders. Regular vulnerability scanning focused on OLAP components and continuous monitoring of database activity logs for anomalous privilege escalation attempts are also recommended defensive measures.