Description
Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as unauthorized update, insert or delete access to some of Oracle Essbase accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
Published: 2026-10-20
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data access and modification in Oracle Essbase
Action: Immediate Patch
AI Analysis

Impact

A flaw in the Oracle Essbase Web Platform allows an attacker with network-level HTTP access and low privileges to bypass authentication checks and read or alter data, leading to high confidentiality impact and low integrity impact, exposing sensitive information and permitting unauthorized modifications.

Affected Systems

Oracle Essbase version 21.8.3.0.0 is confirmed affected; advisory notes a scope change that could impact other Oracle products that interface with Essbase.

Risk and Exploitability

The CVSS v3.1 base score of 8.5 signals significant risk; the EPSS score is very low (<1%), but the high severity still indicates a serious threat. The attacker only needs network connectivity and minimal effort, implying a reasonable likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, but its high score and broad potential impact warrant immediate attention.

Generated by OpenCVE AI on October 23, 2026 at 18:01 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle security update for Oracle Essbase 21.8.3.0.0 as detailed in the CPUoct2026 advisory.
  • Restrict HTTP access to the Essbase Web Platform to trusted networks or VPNs.
  • Limit user privileges and disable unused services on the Essbase server to reduce attack surface.

Generated by OpenCVE AI on October 23, 2026 at 18:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Title Oracle Essbase Unauthorized Data Access and Modification

Fri, 23 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Wed, 21 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Title Oracle Essbase Unauthorized Data Access and Modification
Weaknesses CWE-284
CWE-862

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as unauthorized update, insert or delete access to some of Oracle Essbase accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
First Time appeared Oracle
Oracle essbase
CPEs cpe:2.3:a:oracle:essbase:21.8.3.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle essbase
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N'}

Subscriptions

Oracle Essbase
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T13:13:46.389Z

Reserved: 2026-09-14T22:10:16.650Z

Link: CVE-2026-91653

cve-icon Vulnrichment

Updated: 2026-10-27T13:13:41.669Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:21:05.567

Modified: 2026-10-27T14:17:05.353

Link: CVE-2026-91653

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T18:15:15Z

Weaknesses