Description
Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Essbase executes to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as unauthorized update, insert or delete access to some of Oracle Essbase accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N).
Published: 2026-10-20
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Confidentiality and Integrity Compromise
Action: Apply Patch
AI Analysis

Impact

The flaw resides in the Java‑Based Agent component of Oracle Essbase version 21.8.3.0.0. A low‑privileged user with local logon can exploit the vulnerability, gaining unauthorized access to Essbase data and, in some cases, inserting or deleting records. The weakness is an implicit authorization failure (CWE‑284).

Affected Systems

Oracle Essbase 21.8.3.0.0 on Oracle’s platform is the only product version identified as impacted by the CNA. No other vendors or product versions are reported as affected.

Risk and Exploitability

The CVSS base score of 6.4 places the vulnerability in the medium range, indicating moderate risk to confidentiality and some integrity impact. The EPSS score of less than 1 % suggests a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog, implying no known active attacks. However, the attack vector is local with low privilege, and the possibility of scope change means additional Oracle products might be affected if the underlying mechanism is leveraged. The weakness is an implicit authorization failure (CWE‑284). Continued monitoring and prompt patching are advised.

Generated by OpenCVE AI on October 28, 2026 at 02:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle Oct 2026 security patch for Essbase 21.8.3.0.0 as detailed in the vendor alert at https://www.oracle.com/security-alerts/cpuoct2026.html.
  • If a patch cannot be applied immediately, restrict local accounts so that only authorized service users can start or interact with the Java Agent, and audit existing user privileges.
  • Segregate the Essbase instance from other services, applying firewall rules and network segmentation to limit exposure to the local attack surface.
  • Review and harden permission settings for database objects accessed by Essbase to prevent unauthorized updates or deletions.

Generated by OpenCVE AI on October 28, 2026 at 02:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 03:15:00 +0000

Type Values Removed Values Added
Title Local Attack on Oracle Essbase Java Agent Enables Unauthorized Data Access

Wed, 28 Oct 2026 01:30:00 +0000

Type Values Removed Values Added
Title Local Privilege Exploit in Oracle Essbase Java Agent Allows Access to Confidential Data
Weaknesses CWE-200

Tue, 27 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 27 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Fri, 23 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
Title Local Privilege Exploit in Oracle Essbase Java Agent Allows Access to Confidential Data
Weaknesses CWE-200

Fri, 23 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation in Oracle Essbase Java Agent
Weaknesses CWE-269
CWE-284

Fri, 23 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Wed, 21 Oct 2026 12:00:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation in Oracle Essbase Java Agent
Weaknesses CWE-269
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Essbase executes to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as unauthorized update, insert or delete access to some of Oracle Essbase accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N).
First Time appeared Oracle
Oracle essbase
CPEs cpe:2.3:a:oracle:essbase:21.8.3.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle essbase
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N'}

Subscriptions

Oracle Essbase
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T21:29:26.191Z

Reserved: 2026-09-14T22:10:16.651Z

Link: CVE-2026-91662

cve-icon Vulnrichment

Updated: 2026-10-27T21:29:21.991Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:21:06.610

Modified: 2026-10-27T22:19:07.563

Link: CVE-2026-91662

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T03:00:15Z

Weaknesses