CVE-2026-91643 in Essbase
Summary
by MITRE • 10/21/2026
Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Java Based Agent component of Oracle Essbase, specifically affecting version 21.8.3.0.0 and potentially other supported releases in that lineage. This security flaw is characterized by an unauthenticated attacker's ability to exploit a weakness through network access via the HTTP protocol. The core technical issue involves insufficient input validation or improper authorization checks within the agent's handling of specific requests, which allows external entities to interact with internal data structures without proper authentication credentials. Because the vulnerability does not require user interaction or complex preconditions beyond basic network connectivity, it presents a significant risk for automated exploitation by threat actors scanning public-facing services.
From an operational perspective, the successful exploitation of this flaw results in unauthorized read access to a subset of Oracle Essbase accessible data. This means that while the attacker cannot modify existing information or disrupt service availability directly through this specific vector, they can extract sensitive business intelligence, financial metrics, and analytical models stored within the system. The impact is primarily confined to confidentiality, as indicated by the CVSS 3.1 base score of 5.3 with a medium severity rating. This level of access could lead to competitive disadvantage if proprietary data is exfiltrated or potentially serve as reconnaissance for further attacks against other components in the enterprise architecture.
In terms of industry standard classifications, this vulnerability aligns closely with CWE-287 Improper Authentication and CWE-200 Exposure of Sensitive Information to an Unauthorized Actor. The attack vector corresponds to ATT&CK technique T1596 Scan Targeted Properties, where adversaries gather information about the target environment through automated scanning tools that probe for known vulnerabilities in web services and agents. The low complexity and lack of required privileges make this a high-priority issue for organizations relying on Oracle Essbase for critical decision-making processes.
Mitigation strategies should prioritize immediate patching to the latest available version of Oracle Essbase released by Oracle, which addresses the underlying code flaws within the Java Based Agent. In environments where patching is not immediately feasible due to operational constraints, network segmentation and strict firewall rules are recommended to restrict HTTP access to the agent interface solely from trusted internal IP ranges or specific application servers that require legitimate interaction with the service. Additionally, implementing Web Application Firewalls can help detect and block anomalous request patterns associated with automated exploitation attempts targeting this vulnerability. Regular security audits and penetration testing should be conducted to ensure no other similar weaknesses exist in adjacent components of the Oracle ecosystem.