Description
Vulnerability in Oracle Essbase (component: Federated Partitions). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as unauthorized update, insert or delete access to some of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).
Published: 2026-10-20
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Exposure and Modification
Action: Immediate Patch
AI Analysis

Impact

A flaw in Oracle Essbase’s Federated Partitions component lets a low‑privileged attacker reach the system over HTTP and read, modify, or delete data while also causing a partial denial of service. The vulnerability carries a CVSS 3.1 base score of 9.1, indicating significant impacts on confidentiality, integrity, and availability. It is easily exploitable from the network and does not require elevated privileges beyond those of an attacker who can send HTTP requests.

Affected Systems

The vulnerability is limited to Oracle Essbase version 21.8.3.0.0, the only supported release identified as affected by Oracle.

Risk and Exploitability

The advisory identifies an EPSS score of 0.00208 and notes that the vulnerability is not listed in CISA's KEV catalog, but the high CVSS, network-based attack vector, and lack of mitigations in the affected version mean that exploitation risk remains high. An attacker can send a crafted HTTP request to the Federated Partitions endpoint, bypassing access controls to obtain arbitrary data or perform destructive updates, and can also target the service to reduce availability partially.

Generated by OpenCVE AI on October 23, 2026 at 21:03 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle Essbase patch for version 21.8.3.0.0 or upgrade to a later, fixed release.
  • Restrict HTTP access to Essbase by limiting it to trusted networks or enforcing IP allow‑lists and firewalls.
  • Disable Federated Partitions if not required, or enforce strict access control policies and audit logs for all data modification operations.

Generated by OpenCVE AI on October 23, 2026 at 21:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Title Remote Data Disclosure and Modification via Oracle Essbase Federated Partitions
Weaknesses CWE-284
CWE-400
CWE-639

Fri, 23 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Title Oracle Essbase Federated Partitions Unauthorized Data Access Vulnerability
Weaknesses CWE-284
CWE-287
CWE-640

Fri, 23 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Wed, 21 Oct 2026 11:15:00 +0000

Type Values Removed Values Added
Title Oracle Essbase Federated Partitions Unauthorized Data Access Vulnerability
Weaknesses CWE-284
CWE-287
CWE-640

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle Essbase (component: Federated Partitions). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as unauthorized update, insert or delete access to some of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).
First Time appeared Oracle
Oracle essbase
CPEs cpe:2.3:a:oracle:essbase:21.8.3.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle essbase
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L'}

Subscriptions

Oracle Essbase
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T21:24:14.318Z

Reserved: 2026-09-14T22:10:16.650Z

Link: CVE-2026-91656

cve-icon Vulnrichment

Updated: 2026-10-27T21:24:08.379Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:21:05.920

Modified: 2026-10-27T22:19:06.947

Link: CVE-2026-91656

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T21:15:16Z

Weaknesses