CVE-2026-91655 in Essbase
Summary
by MITRE • 10/21/2026
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as unauthorized update, insert or delete access to some of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the security component of Oracle Essbase version 21.8.3.0.0, representing a critical flaw that allows for unauthorized access and manipulation of data through network-based attacks. This issue is classified as easily exploitable by an attacker with low privileges who possesses network access via HTTP. The severity of this vulnerability is underscored by its high impact on confidentiality, integrity, and availability, resulting in a CVSS 3.1 Base Score of 9.1. The specific vector indicates that the attack requires no user interaction, has low complexity, but necessitates local or adjacent network privileges to execute successfully.
From a technical perspective, this vulnerability enables an attacker with minimal initial access rights to escalate their privilege level and compromise the integrity of the Oracle Essbase environment. Once exploited, the attacker gains unauthorized read access to critical data stored within the system, effectively breaching confidentiality controls. Furthermore, the flaw permits unauthorized modifications to the database structure and content, allowing for insertions, updates, or deletions of records that should be protected by standard security policies. This capability directly impacts the integrity of the information systems managed by Oracle Essbase, potentially leading to data corruption or malicious alteration of analytical models and business intelligence outputs.
The operational impact extends beyond simple data theft due to the scope change characteristic noted in the advisory. While the vulnerability is technically located within Oracle Essbase, successful exploitation can significantly impact additional products that rely on this component for security services or data processing. This lateral movement potential amplifies the risk profile, as a compromise of Essbase could serve as an entry point into broader enterprise infrastructure. Additionally, the vulnerability allows attackers to cause a partial denial of service by consuming system resources or disrupting normal operational workflows, thereby affecting availability and potentially causing downtime for critical business operations that depend on real-time data analysis and reporting capabilities provided by Oracle Essbase.
In alignment with industry standards, this vulnerability maps closely to CWE-269 Improper Privilege Management, as it allows a low-privileged user to perform actions reserved for higher-level administrators or system processes. It also relates to CWE-862 Missing Authorization, where the application fails to properly verify that the requesting entity has permission to access specific resources before fulfilling the request. From an offensive security standpoint, this aligns with MITRE ATT&CK techniques involving Initial Access and Privilege Escalation, particularly those leveraging network services like HTTP for exploitation without requiring user interaction or social engineering tactics.
To mitigate these risks, organizations running Oracle Essbase version 21.8.3.0.0 should immediately apply the latest security patches provided by Oracle to address this specific flaw in the security component. It is crucial to ensure that all dependent systems are also reviewed for potential exposure resulting from the scope change mentioned in the advisory. Network segmentation strategies should be reinforced to limit HTTP access to Essbase servers, ensuring that only authorized and trusted IP addresses can communicate with these services. Additionally, implementing strict input validation and enforcing principle of least privilege across all user accounts associated with Oracle Essbase will help reduce the attack surface. Regular security audits and penetration testing focused on authentication mechanisms and data integrity controls are recommended to detect any signs of exploitation or misconfiguration that could be leveraged by attackers.