CVE-2026-91641 in Essbase
Summary
by MITRE • 10/22/2026
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the Security component of Oracle Essbase, specifically affecting version 21.8.3.0.0 and potentially other supported releases depending on configuration. This flaw represents a critical security deficiency that allows for unauthorized access to sensitive data stored within the application environment. The nature of this vulnerability is characterized by its ease of exploitation, requiring only low-privileged credentials from an attacker who has network connectivity via HTTP to the affected system. Unlike complex exploits that demand high privilege levels or user interaction, this weakness can be leveraged by attackers with minimal access rights, significantly lowering the barrier for entry in environments where basic user accounts are provisioned without strict monitoring or least-privilege enforcement.
From a technical perspective, the flaw enables an attacker to bypass intended security controls and retrieve data that should remain restricted. The impact is primarily confined to confidentiality, as indicated by the CVSS 3.1 base score of 5.0 with a vector indicating network accessibility, low attack complexity, no user interaction required, and significant scope change. This means that while integrity and availability are not directly compromised in this specific instance, the unauthorized read access allows for the exfiltration of proprietary business intelligence data, financial records, or strategic planning information housed within Essbase cubes. The scope change noted implies that compromising Oracle Essbase through this vector can lead to broader consequences across additional products integrated with it, potentially creating a chain reaction of data exposure in interconnected enterprise systems.
In terms of industry standard classifications, this vulnerability aligns closely with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials if the low privilege requirement stems from default configurations or weak authentication mechanisms. Furthermore, within the MITRE ATT&CK framework, this behavior corresponds to techniques such as T1078 Valid Accounts, where attackers utilize legitimate credentials to gain access, and potentially T1530 Data from Cloud Storage if the data is accessed remotely via HTTP endpoints. The ability of a low-privileged user to read sensitive subsets of data suggests a failure in implementing proper role-based access control or object-level security checks within the application logic.
The operational impact of this vulnerability extends beyond immediate data loss. It poses a significant risk to organizational compliance and reputation, particularly if the exposed data includes personally identifiable information or regulated financial metrics. Attackers can use this unauthorized access as a foothold for further reconnaissance, mapping out the internal network structure and identifying higher-value targets within the enterprise architecture. The lack of required user interaction makes automated scanning tools highly effective at detecting and exploiting this weakness across large deployments, increasing the likelihood of widespread compromise if left unpatched.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Oracle has likely released a patch or update for version 21.8.3.0.0 that addresses these security flaws; applying the latest critical patches is the primary defense. Additionally, organizations should enforce strict network segmentation to limit HTTP access to Essbase servers only from trusted subnets. Implementing multi-factor authentication and ensuring that all user accounts adhere to the principle of least privilege can reduce the risk associated with low-privileged attackers. Regular security audits and penetration testing focused on access control mechanisms will help identify similar weaknesses before they are exploited in production environments. Monitoring logs for unusual data retrieval patterns by low-privilege users is also recommended to detect potential exploitation attempts early.