CVE-2026-91642

HighCVSS 7.3

Published: 20/10/2026(UTC)Updated: 27/10/2026(UTC)Translated: 21/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

17th percentile - higher than 17% of all known CVEs

Summary

Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable HTTP attack by an unauthenticated attacker allows updating, inserting or deleting some data, unauthorized read of a subset of data and partial denial of service.

Risk Assessment

An attacker could modify data, gain unauthorized read access to some data and cause partial service unavailability. CVSS 7.3 indicates significant confidentiality, integrity and availability risk.

Recommendation

Apply Oracle's Essbase fix and restrict access to the HTTP interface.

Other vulnerabilities in Oracle Essbase

See all

Original NVD description (English source)

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Essbase accessible data as well as unauthorized read access to a subset of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS