{"id":"CVE-2026-91637","published":"2026-10-20T22:21:03.693","lastModified":"2026-10-23T14:56:37.227","description":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-284"],"vendors":["oracle"],"products":["essbase"],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Oracle Essbase 21.8.3.0.0 contains a critical security vulnerability that allows low-privileged attackers with network access to fully compromise the system, affecting confidentiality, integrity, and availability. This vulnerability can lead to unauthorized access to sensitive business intelligence data and potential takeover of the entire Essbase platform.","exploitability":"The vulnerability is easily exploitable with low privileges over HTTP, requiring only network access to the affected Oracle Essbase instance running version 21.8.3.0.0.","blast_radius":"Successful exploitation could compromise the entire Oracle Essbase system and potentially impact other connected products due to the scope change, affecting business intelligence and analytics platforms across the organization.","remediation":"Upgrade to Oracle Essbase 21.8.4.0.0 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["database","security","enterprise"],"model":"garnet-coder","analyzedAt":"2026-10-21T01:20:59.635Z"}}