Description
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as unauthorized update, insert or delete access to some of Oracle Essbase accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).
Published: 2026-10-20
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Access
Action: Immediate Patch
AI Analysis

Impact

The vulnerability in the Security component of Oracle Essbase permits an unauthenticated attacker with network access over HTTP to read, insert, update, or delete data that should be protected, compromising confidentiality and integrity without authentication or user interaction. The weakness is an example of improper authentication (CWE‑287) and improper access control (CWE‑284).

Affected Systems

Oracle Essbase version 21.8.3.0.0 is the only version listed as affected. No other versions of Essbase or Oracle products are explicitly mentioned as compromised; however, the CVE indicates that scope change could allow impact on other Oracle products that share this security component.

Risk and Exploitability

The CVSS v3.1 base score of 9.3 indicates high severity, and the vector shows remote access (AV:N) with no authentication or privileges required (PR:N). The EPSS score of < 1 % suggests a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The scope change (S:C) still warrants swift remediation because the vulnerability can affect additional components beyond the initial target.

Generated by OpenCVE AI on October 23, 2026 at 22:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle CPU Oct 2026 patch that addresses the Essbase Security component flaw.
  • Restrict HTTP traffic to the Essbase server to trusted hosts or VPNs using firewall or network segmentation.
  • Enable detailed logging and auditing of read, update, insert, and delete operations on Essbase data, and monitor for anomalous activity.

Generated by OpenCVE AI on October 23, 2026 at 22:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Vulnerability in Oracle Essbase 21.8.3.0.0
Weaknesses CWE-284
CWE-287

Fri, 23 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Unauthorized Data Manipulation in Oracle Essbase
Weaknesses CWE-284
CWE-863

Fri, 23 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Wed, 21 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Unauthorized Data Manipulation in Oracle Essbase
Weaknesses CWE-284
CWE-863

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as unauthorized update, insert or delete access to some of Oracle Essbase accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).
First Time appeared Oracle
Oracle essbase
CPEs cpe:2.3:a:oracle:essbase:21.8.3.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle essbase
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N'}

Subscriptions

Oracle Essbase
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T13:04:11.385Z

Reserved: 2026-09-14T22:10:16.650Z

Link: CVE-2026-91644

cve-icon Vulnrichment

Updated: 2026-10-27T13:04:07.321Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:21:04.543

Modified: 2026-10-27T13:17:01.900

Link: CVE-2026-91644

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T22:45:14Z

Weaknesses