CVE-2026-91656
CriticalCVSS 9.1Summary
Vulnerability in Oracle Essbase (component: Federated Partitions) affecting version 21.8.3.0.0. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data, update, insert or delete it, and cause a partial denial of service, with potential impact on additional products (scope change). CVSS 3.1 Base Score 9.1.
Risk Assessment
A low-privileged attacker can access, modify, or delete critical data and cause partial service disruption. This can lead to severe compromise of confidentiality, integrity, and availability.
Recommendation
Immediately apply the patches provided by Oracle for Oracle Essbase. Restrict network access to the Essbase HTTP interface to trusted hosts only.
Other vulnerabilities in Oracle Essbase
See all- CVE-2026-91664High
A vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. An easily exploitable flaw allows an unauthenticated attacker with network access via TCP to cause a hang or frequently repeatable crash (full DoS).
- CVE-2026-91661High
A vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or all Oracle Essbase accessible data.
- CVE-2026-91659High
A vulnerability in Oracle Essbase (Build component) affecting version 21.8.3.0.0. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or all Oracle Essbase accessible data.
- CVE-2026-91653High
Vulnerability in Oracle Essbase (component: Essbase Web Platform) affecting version 21.8.3.0.0. A low privileged attacker with network access via HTTP can gain unauthorized access to critical data and update, insert or delete some Essbase data, with possible impact on additional products.
- CVE-2026-91651High
Vulnerability in Oracle Essbase (component: Essbase Web Platform) affecting version 21.8.3.0.0. A difficult to exploit HTTP attack by a low privileged attacker can lead to takeover of Essbase and impact additional products.
- CVE-2026-91647High
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. A difficult to exploit TCP attack by an unauthenticated attacker can lead to takeover of Essbase.
- CVE-2026-91642High
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable HTTP attack by an unauthenticated attacker allows updating, inserting or deleting some data, unauthorized read of a subset of data and partial denial of service.
- CVE-2026-91639High
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable HTTP attack by a low privileged attacker allows unauthorized access to critical data or complete access to all Essbase data, with possible impact on additional products.
- CVE-2026-91636High
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable HTTP attack by a low privileged attacker allows unauthorized access to critical data or complete access to all Essbase data, with possible impact on additional products.
- CVE-2026-91635High
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. A difficult to exploit T3 and IIOP attack by an unauthenticated attacker can lead to takeover of Essbase.
Original NVD description (English source)
Vulnerability in Oracle Essbase (component: Federated Partitions). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as unauthorized update, insert or delete access to some of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS