CVE-2026-91642 in Essbase
Summary
by MITRE • 10/21/2026
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Essbase accessible data as well as unauthorized read access to a subset of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Security component of Oracle Essbase version 21.8.3.0.0, presenting a critical risk to organizations relying on this enterprise analytics platform for business intelligence and data analysis operations. This flaw is characterized by its high exploitability, as it permits unauthenticated attackers who possess network access via HTTP to successfully compromise the integrity and availability of the system. The absence of required authentication checks at the entry point allows malicious actors to interact directly with vulnerable endpoints without prior credentials, significantly lowering the barrier for exploitation compared to vulnerabilities that require user interaction or valid login sessions.
From a technical perspective, this vulnerability enables unauthorized modifications to accessible data within Oracle Essbase, including updates, inserts, and deletions. This capability indicates a failure in proper access control mechanisms, allowing external entities to alter critical analytical datasets without authorization. Furthermore, the flaw grants unauthorized read access to a subset of sensitive information stored or processed by the application. The combination of these capabilities suggests that the vulnerability likely stems from improper validation of input parameters or insufficient enforcement of security policies on specific API endpoints or web services exposed through HTTP. This aligns with common weaknesses found in complex enterprise applications where dynamic content generation and data retrieval mechanisms may not adequately sanitize inputs or verify permissions before executing database operations.
The operational impact of this vulnerability is severe, encompassing breaches of confidentiality, integrity, and availability as reflected by a CVSS 3.1 Base Score of 7.3. The unauthorized read access poses a direct threat to data privacy and intellectual property, potentially exposing proprietary business metrics or customer information. Simultaneously, the ability to perform unauthorized updates, inserts, or deletes compromises data integrity, which can lead to corrupted analytics reports, flawed decision-making processes, and loss of trust in the system's outputs. Additionally, the vulnerability allows for a partial denial of service, meaning attackers can disrupt normal operations by consuming resources or causing errors that degrade performance or temporarily halt functionality. This triad of impacts underscores the critical nature of the flaw, as it affects all three pillars of information security simultaneously.
In terms of industry standard classifications, this vulnerability maps to CWE-269 Improper Privilege Management and CWE-862 Missing Authorization, reflecting the lack of proper access control checks for unauthenticated users. The ability to modify data corresponds to CWE-74 Injection in contexts where input is not properly sanitized before database execution, while the denial of service aspect relates to CWE-400 Uncontrolled Resource Consumption. From a tactical standpoint within the MITRE ATT&CK framework, this vulnerability facilitates Initial Access through Exploitation for Credential Access or Direct System Access and can be leveraged for Data Exfiltration via Network Service Exposure. Attackers may also utilize techniques associated with Impact such as Data Manipulation or Service Stop to achieve their objectives after gaining initial foothold.
Mitigation strategies should prioritize immediate patching of Oracle Essbase to the latest available version that addresses this specific security flaw, ensuring that all components including the Security module are updated consistently across the environment. In cases where patching is not immediately feasible, network-level controls such as Web Application Firewalls can be configured to block requests targeting known vulnerable endpoints or patterns associated with exploitation attempts. It is also recommended to restrict HTTP access to essential services and enforce strict firewall rules that limit exposure of Essbase interfaces to trusted IP ranges only. Regular security audits and penetration testing should be conducted to identify similar misconfigurations in other components, ensuring a holistic approach to securing the analytics infrastructure against unauthenticated attacks.