CVE-2026-91643

Modified Modified - Updated After Analysis

Oracle Essbase Unauthorized Data Read Vulnerability

Publication date: 2026-10-20

Last updated on: 2026-10-27

Assigner: Oracle

Description

Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-27

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-91643

EUVD

EUVD-2026-106830

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	essbase	21.8.3.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Essbase version 21.8.3.0.0. It allows an unauthenticated attacker with network access via HTTP to potentially read a subset of data stored in Oracle Essbase. The vulnerability has a CVSS base score of 5.3, indicating a medium severity with confidentiality impact.

Detection Guidance

This vulnerability affects Oracle Essbase 21.8.3.0.0 via HTTP. Detection may involve checking for unauthenticated access to Oracle Essbase components or unusual network traffic patterns. Verify if the system is running the affected version and inspect HTTP logs for suspicious requests targeting Oracle Essbase services.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain unauthorized read access to some of your Oracle Essbase data. This may lead to exposure of sensitive information depending on what data is stored in the system.

Compliance Impact

This vulnerability allows unauthorized read access to a subset of Oracle Essbase data, which could lead to exposure of sensitive information. This may impact compliance with GDPR (data confidentiality requirements) and HIPAA (protected health information safeguards) if the accessed data includes regulated information.

Mitigation Strategies

Apply the latest security patches from Oracle for Oracle Essbase version 21.8.3.0.0. Restrict network access to the Java Based Agent component via HTTP. Monitor network traffic for unauthorized access attempts to the Oracle Essbase service.

Hi! I’m here to help you understand CVE-2026-91643. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...