CVE-2026-91662 in Essbase
Summary
by MITRE • 10/21/2026
Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Essbase executes to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as unauthorized update, insert or delete access to some of Oracle Essbase accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Java Based Agent component of Oracle Essbase, specifically affecting version 21.8.3.0.0 and potentially other supported releases depending on configuration. This security flaw is characterized by a difficulty in exploitation that requires an attacker to possess low-level privileges and valid logon credentials to the infrastructure hosting the Oracle Essbase service. The nature of this vulnerability suggests it does not stem from simple remote code execution or unauthenticated access, but rather from improper handling of data or state within the application logic when processed through the Java agent interface. This aligns with common patterns found in CWE-20 Improper Input Validation or CWE-798 Use of Hard-coded Credentials if authentication bypass is involved, though the specific vector indicates a need for local access and low privileges to trigger the flaw.
The operational impact of this vulnerability extends beyond the immediate compromise of Oracle Essbase due to its potential scope change. While the direct target is the Essbase application server, successful exploitation can lead to unauthorized access to critical data stored within the system. This includes both read operations that expose sensitive information and write operations such as unauthorized updates, inserts, or deletes against accessible datasets. The CVSS 3.1 base score of 6.4 reflects a medium severity rating driven primarily by high confidentiality impact and low integrity impact, with no direct availability impact noted in the vector. This indicates that while data privacy is severely compromised, system uptime may remain unaffected unless secondary effects are triggered through data manipulation.
From an attacker perspective, this vulnerability represents a significant risk for lateral movement or privilege escalation within enterprise environments where Oracle Essbase is deployed as part of larger business intelligence architectures. The requirement for low privileged access means that attackers who have already gained entry into the network perimeter can leverage this flaw to escalate their influence over data integrity and confidentiality. This behavior maps closely to MITRE ATT&CK techniques related to Data Staged or Unsecured Credentials, particularly if the attacker uses existing valid credentials to interact with the vulnerable component. The scope change aspect implies that compromising Essbase could provide a foothold for attacking adjacent systems or databases connected through shared infrastructure or network segments, thereby amplifying the blast radius of the initial breach.
Mitigation strategies should focus on strict access control and environment hardening rather than relying solely on patching, given the difficulty of exploitation which may delay immediate remediation in some cases. Administrators must ensure that only authorized users with minimal necessary privileges can interact with the Java Based Agent interface. Network segmentation is critical to isolate Essbase servers from general user workstations and less trusted network zones. Additionally, implementing robust monitoring for unusual data access patterns or unexpected write operations within Essbase databases can help detect exploitation attempts early. Regular updates to Oracle Essentials components are essential as patches become available, but immediate focus should be on reducing the attack surface by restricting local logon capabilities and enforcing multi-factor authentication where applicable to mitigate the risk of credential-based attacks exploiting this flaw.