CVE-2026-91645 in Essbase
Summary
by MITRE • 10/22/2026
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the security component of Oracle Essbase, specifically affecting version 21.8.3.0.0 and potentially other supported releases in that lineage. This flaw represents a critical weakness in the application's authentication and authorization mechanisms, allowing for unauthorized access to sensitive information without requiring valid credentials from an external actor. The vulnerability is classified as easily exploitable because it does not require user interaction or complex preconditions beyond basic network connectivity. An attacker positioned on the same network segment or with routing capability can initiate a request via the Hypertext Transfer Protocol (HTTP) interface exposed by the Essbase service to trigger this flaw.
From a technical perspective, the core issue involves insufficient validation of access controls for specific data subsets within the Essbase environment. When an unauthenticated user sends a crafted HTTP request targeting internal endpoints or API calls that handle metadata retrieval or cube browsing operations, the application fails to properly verify whether the requester has legitimate permissions to view the requested information. This logic error bypasses standard security checks, effectively treating anonymous requests as authorized for certain read-only operations. The absence of proper session validation or token verification at this specific entry point allows the attacker to extract data that should be restricted to authenticated administrators or designated users with appropriate roles.
The operational impact of this vulnerability is primarily centered on confidentiality breaches rather than integrity or availability disruptions. Successful exploitation results in unauthorized read access to a subset of Oracle Essbase accessible data, which may include sensitive business metrics, financial forecasts, inventory levels, or strategic planning information stored within the multidimensional cubes. While the attacker cannot modify existing data or disrupt service operations directly through this specific vector, the exposure of proprietary analytical data can lead to significant competitive disadvantage and regulatory compliance issues depending on the nature of the exposed records. The severity is quantified by a CVSS 3.1 Base Score of 5.3, indicating a medium level of risk driven entirely by confidentiality impacts with no effect on integrity or availability.
In terms of industry standard classifications, this vulnerability aligns closely with CWE-287 Improper Authentication and CWE-862 Missing Authorization within the Common Weakness Enumeration framework. The attack vector corresponds to ATT&CK technique T1078 Valid Accounts if the attacker leverages stolen credentials later, but in its initial state as an unauthenticated exploit, it maps more directly to reconnaissance activities such as T1592 Gather Victim Host Information or data exfiltration patterns like T1005 Data from Local System. The network-based nature of the attack via HTTP places it within remote exploitation scenarios that are particularly dangerous for internet-facing services or poorly segmented internal networks where lateral movement is possible after initial access.
Mitigation strategies must focus on immediate patching and enhanced perimeter defenses. Oracle has released updates to address this specific flaw in version 21.8.3.0.0, so applying the latest security patches provided by Oracle for Essbase is the primary remediation step. Organizations should verify their current build number against Oracle's critical patch update documentation to ensure they are running a patched release. Additionally, implementing strict network segmentation can limit exposure by ensuring that only authorized application servers and management consoles have HTTP access to the Essbase instance. Deploying Web Application Firewalls with rulesets tuned for authentication bypass patterns may also help detect or block exploitation attempts before they reach the vulnerable component until patches are fully deployed across all environments.