CVE-2026-91648

Modified Modified - Updated After Analysis

Unauthenticated Data Read in Oracle Essbase

Publication date: 2026-10-20

Last updated on: 2026-10-27

Assigner: Oracle

Description

Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-27

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-91648

EUVD

EUVD-2026-106835

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	essbase	21.8.3.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Essbase version 21.8.3.0.0. It allows an unauthenticated attacker with network access to read a subset of data stored in Oracle Essbase without needing to log in. The attack is possible via TCP and does not require user interaction.

Detection Guidance

Detecting this vulnerability requires checking for exposed Oracle Essbase instances with TCP access. Use network scanning tools like nmap to identify hosts running Oracle Essbase on default ports (typically 1423, 1424, or 9000). Example command: nmap -p 1423,1424,9000 <target_IP>. Verify if the service responds without authentication.

Impact Analysis

If you use Oracle Essbase 21.8.3.0.0, an attacker could access some of your stored data without authorization. This could lead to data leaks or unauthorized information exposure, potentially affecting confidentiality of business or user data.

Compliance Impact

This vulnerability may violate compliance requirements under GDPR or HIPAA by allowing unauthorized access to sensitive data. Organizations using Oracle Essbase 21.8.3.0.0 could face regulatory penalties or audit failures due to insufficient data protection.

Mitigation Strategies

Immediately restrict network access to Oracle Essbase by blocking TCP ports 1423, 1424, and 9000 at the firewall. Apply Oracle's official patch or upgrade to a non-vulnerable version (21.8.3.0.0 or later). If patching is delayed, disable the Java Based Agent component if not required.

Hi! I’m here to help you understand CVE-2026-91648. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...