Oracle Essbase: Improper access control in Security component
Summary
Oracle Essbase 21.8.3.0.0, an OLAP analytics server typically used for finance and planning, contains an improper access control flaw in its Security component (CVE-2026-91658, CVSS 9.9). An attacker with a low-privileged account and network access via HTTP can take over the server, and the scope change means the impact can extend to other products. No active exploitation or public proof of concept is known at the time of publication.
Affected
- Oracle Essbase 21.8.3.0.0
Fixed in
- Oracle October 2026 Critical Patch Update (CPU), released 20 October 2026
- Patch ID: Unknown. Confirm the Essbase patch ID in Oracle's advisory.
Workaround
- No vendor workaround known. Patching is the remedy.
- General hardening (not verified for this CVE): restrict HTTP access to the Essbase server to trusted networks or VPN and review accounts with access.
Exploitation
- Not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
- No public proof of concept known.
- CISA SSVC: exploitation none, not automatable.
- EPSS score: 0.00286.
Our recommendation
- Check whether Essbase 21.8.3.0.0 is deployed and where, especially in finance or planning environments.
- Apply the October 2026 CPU patch after confirming the patch ID in Oracle's advisory.
- Until patched, restrict HTTP access to trusted networks and review low-privileged accounts.
- Monitor for changes in KEV status or public proof-of-concept code.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert: October 2026 CPU www.oracle.com
- OpenCVE: CVE-2026-91658 app.opencve.io
- Vulners: CVE-2026-91658 vulners.com
- TheHackerWire: CVE-2026-91658 www.thehackerwire.com
- Waratek: October 2026 Critical Patch Update waratek.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:02.
Original description (NVD)
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.