CVE-2026-91651
HighCVSS 8.5Summary
Vulnerability in Oracle Essbase (component: Essbase Web Platform) affecting version 21.8.3.0.0. A difficult to exploit HTTP attack by a low privileged attacker can lead to takeover of Essbase and impact additional products.
Risk Assessment
Takeover of Essbase could fully compromise confidentiality, integrity and availability and affect related products. CVSS 8.5 indicates high risk.
Recommendation
Apply Oracle's Essbase fix and restrict access to the web interface to trusted networks.
Other vulnerabilities in Oracle Essbase
See all- CVE-2026-91664High
A vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. An easily exploitable flaw allows an unauthenticated attacker with network access via TCP to cause a hang or frequently repeatable crash (full DoS).
- CVE-2026-91661High
A vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or all Oracle Essbase accessible data.
- CVE-2026-91659High
A vulnerability in Oracle Essbase (Build component) affecting version 21.8.3.0.0. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or all Oracle Essbase accessible data.
- CVE-2026-91653High
Vulnerability in Oracle Essbase (component: Essbase Web Platform) affecting version 21.8.3.0.0. A low privileged attacker with network access via HTTP can gain unauthorized access to critical data and update, insert or delete some Essbase data, with possible impact on additional products.
- CVE-2026-91647High
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. A difficult to exploit TCP attack by an unauthenticated attacker can lead to takeover of Essbase.
- CVE-2026-91642High
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable HTTP attack by an unauthenticated attacker allows updating, inserting or deleting some data, unauthorized read of a subset of data and partial denial of service.
- CVE-2026-91639High
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable HTTP attack by a low privileged attacker allows unauthorized access to critical data or complete access to all Essbase data, with possible impact on additional products.
- CVE-2026-91636High
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable HTTP attack by a low privileged attacker allows unauthorized access to critical data or complete access to all Essbase data, with possible impact on additional products.
- CVE-2026-91635High
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. A difficult to exploit T3 and IIOP attack by an unauthenticated attacker can lead to takeover of Essbase.
- CVE-2026-91632High
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable HTTP attack by a low privileged attacker allows unauthorized access to critical data or complete access to all Essbase data, with possible impact on additional products.
Original NVD description (English source)
Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS