Description
Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Disclosure
Action: Apply Patch
AI Analysis

Impact

The vulnerability in Oracle Essbase’s Java Based Agent allows an unauthenticated attacker with network access via HTTP to read a subset of data. No authentication or user interaction is required, and the impact is confined to confidentiality loss through unauthorized data disclosure. The attack does not provide integrity or availability effects.

Affected Systems

Affected is Oracle Essbase version 21.8.3.0.0. Only this supported release is impacted.

Risk and Exploitability

The CVSS 3.1 Base Score of 5.3 indicates a moderate risk to confidentiality. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet, though the ability to reach the agent over HTTP makes it potentially vulnerable to local or remote abuse. The attack vector is inferred to be remote over HTTP, requiring no credentials.

Generated by OpenCVE AI on October 23, 2026 at 21:07 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official Oracle Essbase patch for version 21.8.3.0.0 as detailed in the Oracle security advisory
  • Block or restrict HTTP access to the Java Based Agent using firewall rules, network segmentation, or IP whitelisting
  • Configure the Essbase agent to require authentication before allowing any read access or disable anonymous user permissions

Generated by OpenCVE AI on October 23, 2026 at 21:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Disclosure in Oracle Essbase Java Based Agent
Weaknesses CWE-200
CWE-287

Fri, 23 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Allows Data Disclosure in Oracle Essbase
Weaknesses CWE-200
CWE-287

Fri, 23 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Wed, 21 Oct 2026 11:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Allows Data Disclosure in Oracle Essbase
Weaknesses CWE-200
CWE-287

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle essbase
CPEs cpe:2.3:a:oracle:essbase:21.8.3.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle essbase
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Essbase
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T13:03:24.866Z

Reserved: 2026-09-14T22:10:16.650Z

Link: CVE-2026-91643

cve-icon Vulnrichment

Updated: 2026-10-27T13:03:19.771Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:21:04.430

Modified: 2026-10-27T13:17:01.780

Link: CVE-2026-91643

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T21:15:16Z

Weaknesses