{"id":"CVE-2026-91638","published":"2026-10-20T22:21:03.817","lastModified":"2026-10-23T17:19:18.217","description":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-284"],"vendors":["oracle"],"products":["essbase"],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Oracle Essbase security vulnerability allows low-privileged attackers with network access to fully compromise the system, affecting confidentiality, integrity, and availability. This critical flaw in version 21.8.3.0.0 enables unauthorized access that can extend beyond Essbase to other products.","exploitability":"Highly exploitable vulnerability requiring only low privilege and network access via HTTP, with no additional preconditions needed for successful exploitation.","blast_radius":"Successful exploitation could lead to complete takeover of Oracle Essbase and potentially impact other connected systems due to the scope change in affected products.","remediation":"Upgrade to Oracle Essbase 21.8.3.0.0 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["database","security","enterprise"],"model":"garnet-coder","analyzedAt":"2026-10-21T01:21:04.400Z"}}