Description
Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Disclosure
Action: Apply Patch
AI Analysis

Impact

A flaw in the Java Based Agent of Oracle Essbase permits an unauthenticated attacker who can reach the service over TCP to read a subset of data stored in Essbase. The vulnerability does not compromise system integrity or availability, but it allows a confidential data breach because data can be read without valid credentials.

Affected Systems

Oracle Essbase version 21.8.3.0.0 is affected. The issue resides in the Java Based Agent component of the database system.

Risk and Exploitability

The CVSS 3.1 base score is 5.3, reflecting a moderate impact on confidentiality. EPSS data indicates a very low exploitation probability (<1%), suggesting that exploitation is unlikely at present, and the vulnerability is not listed in CISA KEV. The attack vector is inferred to be remote over the network via TCP and requires no authentication, making the vulnerability relatively easy to exploit once network access is possible.

Generated by OpenCVE AI on October 23, 2026 at 21:06 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle security patch for Essbase 21.8.3.0.0 as detailed in the official advisory
  • Restrict network access to the Java Based Agent using firewall or network segmentation
  • Configure strict audit logging and monitor for unauthorized access attempts on the Essbase service

Generated by OpenCVE AI on October 23, 2026 at 21:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Data Disclosure in Oracle Essbase via Java Based Agent
Weaknesses CWE-200

Fri, 23 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Access Enabling Confidential Data Disclosure in Oracle Essbase
Weaknesses CWE-284

Fri, 23 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Wed, 21 Oct 2026 11:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Access Enabling Confidential Data Disclosure in Oracle Essbase
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle essbase
CPEs cpe:2.3:a:oracle:essbase:21.8.3.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle essbase
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Essbase
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T13:07:37.356Z

Reserved: 2026-09-14T22:10:16.650Z

Link: CVE-2026-91648

cve-icon Vulnrichment

Updated: 2026-10-27T13:07:31.575Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:21:05.017

Modified: 2026-10-27T14:17:04.857

Link: CVE-2026-91648

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T21:15:16Z

Weaknesses