CVE-2026-91652 in Essbase
Summary
by MITRE • 10/21/2026
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the security component of Oracle Essbase, specifically affecting version 21.8.3.0.0 and potentially other supported releases depending on configuration. This flaw represents a critical weakness in how the application handles authentication and authorization checks for HTTP-based requests. The core technical issue involves an insufficient verification mechanism that allows low-privileged users to bypass expected access controls. By crafting specific network requests over HTTP, an attacker with valid but limited credentials can exploit this logic error to gain unauthorized read access to data subsets within Oracle Essbase. This is not merely a theoretical risk; the vulnerability is easily exploitable in practice due to its simplicity and lack of complex prerequisites beyond basic network connectivity and low-level authentication.
The operational impact of this vulnerability extends beyond the immediate compromise of the affected module. While the direct consequence is unauthorized read access, which aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization, the scope change noted in the advisory indicates that attacks may significantly impact additional products within the Oracle ecosystem. This suggests a potential chain reaction where compromising Essbase could serve as an entry point to adjacent systems or data stores, thereby escalating the risk from isolated information disclosure to broader organizational compromise. The confidentiality impact is rated as low on its own, but when combined with the scope change, the overall threat landscape becomes more severe for enterprises relying on integrated Oracle solutions.
From a tactical perspective, this vulnerability maps directly to MITRE ATT&CK techniques related to Initial Access and Credential Access. Specifically, it aligns with T1078 Valid Accounts, as exploitation requires low-privileged credentials, and potentially T1539 Steal Web Session Cookie if session management is involved in the HTTP request handling. The attack vector being network-accessible via HTTP means that this vulnerability can be exploited remotely without user interaction, making it a high-priority target for automated scanning tools used by threat actors. The absence of required user interface interactions further lowers the barrier to entry for attackers, allowing them to probe and exploit the system programmatically at scale.
Mitigation strategies must focus on immediate patching and network-level controls. Organizations running Oracle Essbase version 21.8.3.0.0 should apply the latest security patches provided by Oracle as soon as they are available in their respective update streams. Until patches can be deployed, it is critical to restrict HTTP access to the affected service through firewall rules or reverse proxy configurations that limit exposure only to trusted IP addresses and users with a legitimate business need. Additionally, implementing strict input validation on all HTTP endpoints related to Essbase security functions can help mitigate exploitation attempts by rejecting malformed requests before they reach the vulnerable code path. Regular audits of user privileges should also be conducted to ensure that low-privileged accounts do not have unnecessary access to sensitive data subsets, thereby reducing the blast radius if an exploit is successful.