CVE-2026-91660 in Essbase
Summary
by MITRE • 10/21/2026
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the security component of Oracle Essbase, specifically affecting version 21.8.3.0.0 and potentially other supported releases in that lineage. This flaw represents a significant risk to organizations relying on this enterprise analytics platform for business intelligence and data analysis operations. The core issue stems from an implementation error within how the application handles incoming HTTP requests related to authentication or session management, allowing attackers with low privileges to trigger conditions that degrade system stability. Because the vulnerability is accessible via standard network protocols without requiring user interaction, it presents a straightforward attack vector for malicious actors operating on adjacent networks or those who have gained initial foothold access through other means.
From a technical perspective, this flaw aligns closely with CWE-400, which describes uncontrolled resource consumption leading to denial of service conditions. The attacker can exploit the vulnerability by sending specific malformed or excessively large HTTP requests that cause the Essbase server processes to enter an unrecoverable state or consume excessive CPU and memory resources. This behavior results in a partial denial of service, meaning while some services may remain operational, critical analytical functions become unavailable or severely degraded for legitimate users. The impact is primarily on availability rather than confidentiality or integrity, as indicated by the CVSS vector components showing no impact to C (Confidentiality) or I (Integrity), but a significant L (Low) impact on A (Availability).
The operational impact of this vulnerability extends beyond simple service interruption. For organizations using Oracle Essbase for real-time financial reporting or strategic planning, even partial downtime can lead to delayed decision-making and potential data inconsistencies if processes are interrupted mid-execution. The requirement for low-privileged access means that an attacker does not need administrative rights to exploit this flaw, lowering the barrier to entry significantly. This characteristic places the vulnerability within the context of ATT&CK technique T1499, Endpoint Denial of Service, specifically under sub-techniques involving resource exhaustion or service disruption through application layer attacks. The network-based nature of the attack further classifies it under initial access vectors that do not require physical proximity to the target infrastructure.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. Oracle has released patches for version 21.8.3.0.0, and applying these updates is the primary defense against this specific flaw. In environments where patching cannot be immediately implemented due to operational constraints, network segmentation should be enforced to restrict HTTP access to Essbase servers from untrusted or low-privilege networks. Additionally, deploying Web Application Firewalls with rulesets designed to detect anomalous request patterns can help mitigate the risk of resource exhaustion attacks by filtering out malicious payloads before they reach the application server. Regular monitoring of system resources and log analysis for unusual spikes in HTTP traffic volume are also recommended to detect potential exploitation attempts early.