CVE-2026-91640
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. It allows a low privileged attacker with network access via HTTP to gain unauthorized read access to a subset of Oracle Essbase accessible data, with potential impact on additional products (scope change).
Risk Assessment
An attacker with basic privileges could read a portion of Essbase data, potentially leading to leakage of business information and affecting related systems.
Recommendation
Update Oracle Essbase to a version containing the security fix and restrict network access to the Essbase HTTP interface to trusted sources.
Other vulnerabilities in Oracle Essbase
See all- CVE-2026-91665Critical
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable vulnerability allows an unauthenticated attacker with network access via TCP to compromise Oracle Essbase. CVSS 3.1 Base Score 9.8.
- CVE-2026-91663Critical
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable vulnerability allows a low-privileged attacker with network access via T3, IIOP to compromise Oracle Essbase, with potential impact on additional products (scope change). CVSS 3.1 Base Score 9.9.
- CVE-2026-91658Critical
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle Essbase, with potential impact on additional products (scope change). CVSS 3.1 Base Score 9.9.
- CVE-2026-91656Critical
Vulnerability in Oracle Essbase (component: Federated Partitions) affecting version 21.8.3.0.0. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data, update, insert or delete it, and cause a partial denial of service, with potential impact on additional products (scope change). CVSS 3.1 Base Score 9.1.
- CVE-2026-91655Critical
Vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. A low-privileged attacker with network access via HTTP can exploit it to gain unauthorized access to critical data, modify data, and cause partial denial of service. CVSS 9.1.
- CVE-2026-91644Critical
Vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. An unauthenticated attacker with network access via HTTP can gain unauthorized access to critical data and modify data. CVSS 9.3.
- CVE-2026-91638Critical
Vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. A low-privileged attacker with network access via HTTP can take over Oracle Essbase. CVSS 9.9.
- CVE-2026-91637Critical
Vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. A low-privileged attacker with network access via HTTP can take over Oracle Essbase. CVSS 9.9.
- CVE-2026-70689Critical
Vulnerability in Oracle Essbase (component: Infrastructure) version 21.8.1.0.0. Easily exploitable by an unauthenticated attacker over HTTP, allowing takeover of the system. CVSS score 9.8.
- CVE-2026-91664High
A vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. An easily exploitable flaw allows an unauthenticated attacker with network access via TCP to cause a hang or frequently repeatable crash (full DoS).
Original NVD description (English source)
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS