CVE-2026-91654 in Essbase
Summary
by MITRE • 10/21/2026
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Essbase accessible data as well as unauthorized read access to a subset of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Security component of Oracle Essbase version 21.8.3.0.0, representing a significant risk to organizations relying on this enterprise analytics platform for business intelligence and data analysis operations. This flaw is characterized by its ease of exploitation, allowing an attacker with low privileges who possesses network access via HTTP to successfully compromise the integrity and availability of the system. The presence of such a vulnerability in a core security module suggests that authentication or authorization mechanisms may be insufficiently enforced when processing specific requests over standard web protocols, thereby bypassing expected privilege boundaries.
From a technical perspective, this flaw enables unauthorized modifications to accessible data within Oracle Essbase, including updates, inserts, and deletes. This directly correlates with CWE-269 Improper Privilege Management or potentially CWE-862 Missing Authorization, as the attacker can perform actions that should be restricted based on their assigned role. Furthermore, the vulnerability permits unauthorized read access to a subset of accessible data, which aligns with CWE-200 Information Exposure and indicates a failure in proper data isolation controls. The ability to cause a partial denial of service further points towards resource exhaustion or state manipulation flaws, potentially mapping to CWE-400 Uncontrolled Resource Consumption or specific application-level DoS vectors where the attacker can disrupt normal operational flow without necessarily crashing the entire system immediately.
The operational impact of this vulnerability is substantial due to its network-based attack vector and low complexity requirements. An adversary does not need user interaction or high-level credentials, making it particularly dangerous in environments where internal networks are trusted but lateral movement is possible. The successful exploitation leads to a compromise of confidentiality through data exfiltration, integrity violations via unauthorized data manipulation that can corrupt analytical models and reports, and availability issues caused by the partial denial of service condition which degrades system performance or renders specific features inaccessible. This triad of impacts results in a CVSS 3.1 Base Score of 6.3, indicating a medium severity level that demands prompt attention to prevent potential data breaches or operational disruptions within critical business intelligence workflows.
In terms of threat modeling and adversary behavior, this vulnerability aligns with ATT&CK techniques related to Initial Access via valid accounts if the low privilege requirement implies existing credentials are needed, followed by Lateral Movement or Data Exfiltration depending on the scope of access gained. The ability to modify data suggests potential for Persistence or Impact tactics as well, particularly if an attacker can inject malicious logic into analytical cubes that affect downstream reporting systems. Organizations must recognize that even partial denial of service capabilities can be leveraged in coordinated attacks to distract security teams while other objectives are pursued within the network perimeter.
Mitigation strategies should prioritize immediate patching to the latest supported version of Oracle Essbase, as vendors typically release updates addressing specific CVEs with refined access controls and input validation logic. Administrators must ensure that all instances running version 21.8.3.0.0 are updated promptly according to official security advisories provided by Oracle. In addition to patching, network segmentation should be reviewed to restrict HTTP access to Essbase servers from untrusted zones or non-essential user segments. Implementing strict input validation and enforcing principle of least privilege across all application roles can help mitigate the risk of unauthorized data manipulation even if similar vulnerabilities exist in other components. Regular vulnerability scanning focused on web-facing applications and monitoring for anomalous patterns in HTTP traffic related to Essbase endpoints will aid in early detection of exploitation attempts before significant damage occurs.