{"id":"CVE-2026-91655","published":"2026-10-20T22:21:05.803","lastModified":"2026-10-23T14:56:48.697","description":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","cwes":[],"vendors":["oracle"],"products":["essbase"],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A vulnerability in Oracle Essbase's Security component allows a low-privileged attacker with network access via HTTP to achieve unauthorized access to critical data, modify some data, and cause a partial denial of service due to improper input validation or access controls.","exploitability":"Easily exploitable by a low-privileged attacker over the network without user interaction.","blast_radius":"Successful exploitation could lead to full read access to all Essbase data, partial data modification, and service disruption, potentially affecting other interconnected systems due to scope change.","remediation":"Upgrade Oracle Essbase to the fixed version 21.8.3.0.0 patch level or later, as specified in the vendor advisory (note: the description does not specify a patched version beyond the affected one; if no fixed version is published, apply Oracle Critical Patch Update guidance and restrict HTTP access to Essbase endpoints until patched).","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","data-exfiltration","dos","web"],"model":"garnet-coder","analyzedAt":"2026-10-26T08:50:22.002Z"}}