CVE-2026-91657 in Essbase
Summary
by MITRE • 10/22/2026
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the Security component of Oracle Essbase, specifically affecting version 21.8.3.0.0 and potentially other supported releases in that lineage. This flaw represents a significant security deficiency that allows for unauthorized access to sensitive information stored within the enterprise analytics platform. The nature of this weakness is categorized under CWE-269, which denotes Improper Privilege Management, indicating that the application fails to correctly enforce or maintain user privileges during critical operations. By failing to properly validate permissions before executing data retrieval requests, the system exposes internal resources to users who should not have access to them according to their assigned roles and security policies.
From a technical perspective, this vulnerability is easily exploitable by an attacker with low privileged credentials over a network connection via HTTP. The attack vector requires no user interaction or complex social engineering tactics, as it relies solely on the misconfiguration of authentication and authorization checks within the web service layer. An adversary can craft specific HTTP requests that bypass standard access controls to query database contents directly. This capability stems from a failure in the server-side logic to verify whether the requesting entity possesses sufficient rights for the specific data subset being accessed, leading to an information disclosure scenario where restricted datasets are returned despite the user lacking explicit permission.
The operational impact of this vulnerability is primarily centered on confidentiality breaches rather than integrity or availability disruptions. Successful exploitation results in unauthorized read access to a subset of Oracle Essbase accessible data. While the attacker cannot modify existing records or disrupt service operations, they can extract sensitive analytical models, financial projections, customer lists, or other proprietary business intelligence stored within the cube structures. This exposure poses severe risks for organizations relying on Essbase for strategic decision-making, as leaked data could be used for competitive analysis, fraud preparation, or further reconnaissance to identify additional attack surfaces within the broader IT infrastructure.
In terms of threat modeling and industry standards, this vulnerability aligns with MITRE ATT&CK technique T1078, Valid Accounts, where attackers use legitimate credentials to gain access to systems they are not authorized for. It also reflects aspects of T1530, Data from Local System, as the attacker extracts data directly from the local storage mechanisms managed by Essbase. The CVSS 3.1 base score of 4.3 with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N confirms that while the attack is straightforward and network-based, its impact is limited to low-level confidentiality loss without affecting system stability or data integrity.
To mitigate this risk, organizations must ensure that Oracle Essbase instances are updated to the latest patch level provided by Oracle, which addresses these specific authorization flaws in the security component. Administrators should also implement strict access control policies using role-based access control principles, ensuring that users only have permissions necessary for their job functions. Network segmentation and firewall rules can further restrict HTTP access to essential personnel or internal networks, reducing the attack surface available to potential adversaries. Regular auditing of user privileges and monitoring for anomalous data retrieval patterns are also recommended practices to detect any attempted exploitation activities early in the kill chain.