CVE-2026-91631 in Essbase
Summary
by MITRE • 10/22/2026
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the security component of Oracle Essbase, specifically affecting version 21.8.3.0.0 and potentially other supported releases depending on configuration. This flaw represents a critical weakness in how the application handles authentication and authorization checks for HTTP-based requests. The core technical issue involves an insufficient verification mechanism that allows low-privileged users to bypass intended access controls when interacting with the service over network protocols. Because the vulnerability is exploitable via standard web traffic, it does not require complex setup or physical proximity, making it accessible to remote attackers who have already gained a foothold within the network perimeter or through compromised credentials.
From an operational perspective, this flaw enables unauthorized read access to a subset of data stored within Oracle Essbase. While the impact is currently classified as limited in scope regarding confidentiality with a CVSS 3.1 base score of five point zero, it signifies that sensitive business intelligence data can be exfiltrated by attackers operating under low privilege levels. The vector indicates that no user interaction is required for exploitation, and the attack complexity is low, which significantly increases the likelihood of successful compromise in environments where network segmentation or strict access policies are not rigorously enforced.
The impact extends beyond Oracle Essbase itself due to a scope change characteristic often seen in integrated enterprise suites. Compromise through this vulnerability may allow lateral movement or data exposure across additional products that share underlying security frameworks or database backends with Essbase. This interconnectedness means that a breach in one component can cascade, potentially exposing broader organizational assets and violating compliance requirements related to data privacy and integrity.
Industry standards classify such flaws under CWE-284 Improper Access Control, which covers scenarios where an actor is able to access resources or functionality they should not be permitted to reach. In the context of the MITRE ATT&CK framework, this vulnerability facilitates unauthorized acquisition of sensitive information through techniques associated with Initial Access and Credential Access if combined with other vectors, though primarily it aligns with Data Exfiltration over a command and control channel if used for data theft. The low privilege requirement suggests that attackers often leverage stolen credentials from phishing or credential stuffing attacks to trigger the exploit.
Mitigation strategies must focus on immediate patching of Oracle Essbase to the latest available version released by Oracle, which addresses the underlying logic errors in the security component. Organizations should also implement strict network segmentation to limit HTTP access to essential management interfaces and ensure that all administrative ports are not exposed to untrusted networks. Additionally, enforcing multi-factor authentication for all user accounts can reduce the risk of low-privileged attackers obtaining valid credentials necessary to trigger this vulnerability. Continuous monitoring of access logs for anomalous read patterns from low-level users is recommended to detect potential exploitation attempts in real time.