CVE-2026-91644 in Essbase
Summary
by MITRE • 10/22/2026
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as unauthorized update, insert or delete access to some of Oracle Essbase accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the security component of Oracle Essbase, specifically affecting version 21.8.3.0.0 and potentially other supported releases depending on configuration. This flaw represents a critical failure in access control mechanisms that allows unauthenticated attackers to compromise the integrity and confidentiality of the system. The attack vector is network-based via HTTP, meaning no physical proximity or local account privileges are required for exploitation. An attacker with basic network connectivity can initiate an exploit against this service without needing valid credentials or user interaction, which significantly lowers the barrier to entry for malicious actors targeting enterprise data warehouses and analytical platforms.
The technical nature of this vulnerability involves a breakdown in authentication checks within the HTTP interface handling sensitive operations. By bypassing these security controls, an attacker gains unauthorized access to critical internal data structures that are normally restricted to authenticated users with specific roles. This flaw enables not only passive reading of confidential information but also active manipulation of the database state. The ability to perform unauthorized updates, inserts, and deletes indicates a severe integrity compromise where attackers can alter analytical models, corrupt datasets, or inject malicious logic into calculation scripts stored within Essbase.
The operational impact of this vulnerability is substantial due to its high severity rating of 9.3 on the CVSS v3.1 scale. The primary consequences involve complete access to all Oracle Essbase accessible data and unauthorized modification capabilities for a subset of that data. In an enterprise environment, Essbase often serves as the backbone for financial planning, sales analytics, and resource management systems. A breach here can lead to significant business disruption, including inaccurate reporting, loss of competitive intelligence, and potential regulatory non-compliance if sensitive customer or financial records are exposed or altered. Furthermore, because attacks may significantly impact additional products through scope change, this vulnerability could serve as a pivot point for lateral movement within the broader Oracle ecosystem, potentially compromising integrated applications that rely on Essbase data services.
From a classification perspective, this issue aligns with CWE-287 Improper Authentication and CWE-94 SQL Injection or similar injection flaws depending on the specific implementation detail of how HTTP requests are processed to bypass checks. In terms of adversary behavior, it maps closely to MITRE ATT&CK techniques related to Initial Access via web applications and potentially Persistence if malicious data is inserted into stored procedures or configuration files. The high availability requirement (AV:N) combined with low complexity (AC:L) and no privileges required (PR:N) underscores the urgency for immediate remediation.
Mitigation strategies must prioritize applying the latest security patches provided by Oracle to update Essbase components beyond version 21.8.3.0.0 or apply specific interim fixes if available for that exact release. Organizations should also implement network-level controls such as Web Application Firewalls (WAFs) configured with rulesets designed to detect and block anomalous HTTP requests targeting authentication endpoints. Restricting direct internet access to Essbase servers by placing them behind internal proxies or load balancers can further reduce the attack surface. Regular vulnerability scanning focused on web-facing components of analytical databases is recommended to ensure that similar misconfigurations are identified before they can be exploited in production environments.