IT SBIT Services
Schneeberger
DEEN
CVE tracker

Oracle Essbase: Improper access control allows remote compromise over HTTP

CVE-2026-91655Critical 9.1

← All vulnerabilities

Summary

Oracle Essbase 21.8.3.0.0 contains a flaw in the Security component (CWE-284, improper access control) that can be exploited over HTTP. An attacker with a valid low-privileged account and network access can affect the confidentiality, integrity and availability of Essbase data and can cause a partial denial of service, with impact beyond Essbase itself (scope change). No user interaction is required. CVSS 3.1 base score: 9.1 (critical).

Affected

  • Oracle Essbase 21.8.3.0.0 (according to the CVE record and Oracle's advisory)
  • Other Essbase versions: Unknown.

Fixed in

  • Fix: Oracle Critical Patch Update, October 2026 (Essbase Security patch set).
  • Specific patch number and fixed release for 21.8.3.0.0: Unknown. Check Oracle's advisory and My Oracle Support for the exact patch.
  • The August 2026 release-update patch (39512186) is not confirmed as a fix for this CVE.

Workaround

  • No vendor workaround known.
  • Until patched, limit access to Essbase HTTP interfaces (network segmentation, reverse proxy or VPN-only access).
  • Review and reduce low-privileged accounts.
  • Monitor Essbase logs.
  • These are general hardening measures, not vendor-confirmed mitigations.

Exploitation

  • CISA SSVC data: Exploitation none, Automatable no.
  • Conflicting claim: one source states the flaw is in the CISA KEV catalogue since 23 October 2026. This is not confirmed; verify in the CISA KEV catalogue.
  • No public proof of concept found.
  • EPSS below 1%.

Our recommendation

  • Apply the October 2026 Critical Patch Update to all Essbase instances, not only for this CVE. The same CPU contains other Essbase flaws, including one unauthenticated flaw rated 9.8.
  • Verify the exact patch level for 21.8.3.0.0 with Oracle.
  • Check whether Essbase or WebLogic HTTP endpoints are reachable from untrusted networks and restrict access.
  • Review accounts with Essbase access and remove unneeded ones.
  • Monitor Essbase logs for unusual access.
  • Verify the KEV status in the CISA catalogue.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:41.

Original description (NVD)

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as unauthorized update, insert or delete access to some of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed