CVE-2026-91648
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Vulnerability in Oracle Essbase (Java Based Agent component) affecting version 21.8.3.0.0. An unauthenticated attacker with TCP network access can gain unauthorized read access to a subset of Essbase data.
Risk Assessment
The lack of authentication requirement makes it easier for an attacker to access a subset of Essbase data over the network.
Recommendation
Apply Oracle's fix and restrict network access to TCP ports used by Essbase.
Other vulnerabilities in Oracle Essbase
See all- CVE-2026-91665Critical
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable vulnerability allows an unauthenticated attacker with network access via TCP to compromise Oracle Essbase. CVSS 3.1 Base Score 9.8.
- CVE-2026-91663Critical
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable vulnerability allows a low-privileged attacker with network access via T3, IIOP to compromise Oracle Essbase, with potential impact on additional products (scope change). CVSS 3.1 Base Score 9.9.
- CVE-2026-91658Critical
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle Essbase, with potential impact on additional products (scope change). CVSS 3.1 Base Score 9.9.
- CVE-2026-91656Critical
Vulnerability in Oracle Essbase (component: Federated Partitions) affecting version 21.8.3.0.0. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data, update, insert or delete it, and cause a partial denial of service, with potential impact on additional products (scope change). CVSS 3.1 Base Score 9.1.
- CVE-2026-91655Critical
Vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. A low-privileged attacker with network access via HTTP can exploit it to gain unauthorized access to critical data, modify data, and cause partial denial of service. CVSS 9.1.
- CVE-2026-91644Critical
Vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. An unauthenticated attacker with network access via HTTP can gain unauthorized access to critical data and modify data. CVSS 9.3.
- CVE-2026-91638Critical
Vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. A low-privileged attacker with network access via HTTP can take over Oracle Essbase. CVSS 9.9.
- CVE-2026-91637Critical
Vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. A low-privileged attacker with network access via HTTP can take over Oracle Essbase. CVSS 9.9.
- CVE-2026-70689Critical
Vulnerability in Oracle Essbase (component: Infrastructure) version 21.8.1.0.0. Easily exploitable by an unauthenticated attacker over HTTP, allowing takeover of the system. CVSS score 9.8.
- CVE-2026-91664High
A vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. An easily exploitable flaw allows an unauthenticated attacker with network access via TCP to cause a hang or frequently repeatable crash (full DoS).
Original NVD description (English source)
Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS