Oracle Essbase Unauthorized Data Read Vulnerability

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Oracle

Description

Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-10-21

AI Q&A

2026-10-21

EPSS Evaluated

N/A

NVD

CVE-2026-91643

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle	Corporation	Oracle Essbase 21.8.3.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Essbase version 21.8.3.0.0. It allows an unauthenticated attacker with network access via HTTP to potentially read a subset of data stored in Oracle Essbase. The vulnerability has a CVSS base score of 5.3, indicating a medium severity with confidentiality impact.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain unauthorized read access to some of your Oracle Essbase data. This may lead to exposure of sensitive information depending on what data is stored in the system.

Mitigation Strategies

Apply the latest security patches from Oracle for Oracle Essbase version 21.8.3.0.0. Restrict network access to the Java Based Agent component via HTTP. Monitor network traffic for unauthorized access attempts to the Oracle Essbase service.

Hi! I’m here to help you understand CVE-2026-91643. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70