CVE-2026-91654

MediumCVSS 6.3

Published: 20/10/2026(UTC)Updated: 27/10/2026(UTC)Translated: 21/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

Vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. A low-privileged attacker with HTTP network access can perform unauthorized update, insert or delete operations, read a subset of data, and cause a partial denial of service.

Risk Assessment

The flaw allows compromise of confidentiality, integrity and availability of Essbase data, potentially leading to incorrect reports and operational disruption.

Recommendation

Promptly install Oracle's fix, restrict access to Essbase, and monitor for unusual data changes.

Other vulnerabilities in Oracle Essbase

See all

Original NVD description (English source)

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Essbase accessible data as well as unauthorized read access to a subset of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS