Description
Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Takeover via Low-Privilege HTTP Attack
Action: Immediate Patch
AI Analysis

Impact

The flaw exists within the Essbase Web Platform component of Oracle Essbase and permits an adversary with only limited privileges who can reach the target via HTTP to fully compromise the application. The vulnerability can lead to loss of confidentiality, integrity, and availability, allowing the attacker to execute arbitrary code or modify data. Based on the description, it is inferred that the weakness stems from improper authentication or access‑control checks.

Affected Systems

Oracle Essbase version 21.8.3.0.0, deployed by Oracle Corporation, is explicitly affected. No other versions or products are listed as impacted, although attacks may have a scope change that could affect additional Oracle or third‑party components that interact with Essbase.

Risk and Exploitability

The CVSS 3.1 base score of 8.5 underscores the high impact of the vulnerability. The attack is possible over standard HTTP traffic and requires only a low‑privileged user, with no prior credentials, making it relatively easy to exploit. The EPSS score is not available, and the issue is not currently listed in CISA’s KEV catalog, but the severity and reachability of the flaw justify a high priority response.

Generated by OpenCVE AI on October 21, 2026 at 11:46 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Deploy the latest Oracle Essbase patch or upgrade to a release that resolves CVE‑2026‑91651
  • If a patch is not immediately available, isolate the Essbase instance from external networks and restrict HTTP access to authenticated, authorized users only
  • Configure continuous monitoring on the Essbase platform to detect anomalous authentication attempts or unexpected query activity, and investigate any suspicious events promptly

Generated by OpenCVE AI on October 21, 2026 at 11:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Attack Enables Full Takeover of Oracle Essbase
Weaknesses CWE-284
CWE-287

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
First Time appeared Oracle
Oracle essbase
CPEs cpe:2.3:a:oracle:essbase:21.8.3.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle essbase
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Oracle Essbase
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-23T11:06:20.785Z

Reserved: 2026-09-14T22:10:16.650Z

Link: CVE-2026-91651

cve-icon Vulnrichment

Updated: 2026-10-23T10:57:35.891Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:21:05.350

Modified: 2026-10-23T14:59:36.610

Link: CVE-2026-91651

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T22:30:12Z

Weaknesses