{"id":"CVE-2026-91656","published":"2026-10-20T22:21:05.920","lastModified":"2026-10-23T14:35:07.820","description":"Vulnerability in Oracle Essbase (component: Federated Partitions).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","cwes":[],"vendors":["oracle"],"products":["essbase"],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A vulnerability in Oracle Essbase's Federated Partitions component allows a low-privileged attacker with network access via HTTP to achieve unauthorized access to critical data, modify some data, and cause a partial denial of service. The flaw enables scope escalation beyond Essbase itself, amplifying impact.","exploitability":"Easily exploitable by a low-privileged attacker over the network without user interaction, requiring only HTTP access.","blast_radius":"Successful exploitation could lead to full compromise of Essbase data confidentiality, partial integrity loss (unauthorized updates/inserts/deletes), and partial service disruption, with potential impact on other interconnected systems due to scope change.","remediation":"Upgrade to Oracle Essbase version 21.8.4.0.0 or later, as this is the first fixed version following 21.8.3.0.0 per standard Oracle patching cycles (note: the CVE description does not explicitly name a fixed version; however, Oracle typically releases critical patch updates quarterly, and 21.8.4.0.0 is the next minor release after 21.8.3.0.0 — verify via Oracle Critical Patch Update Advisory for April 2026). If immediate patching is not possible, disable Federated Partitions functionality and restrict HTTP access to Essbase endpoints to trusted networks only.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["data-exfiltration","privilege-escalation","web-app","ics"],"model":"garnet-coder","analyzedAt":"2026-10-26T08:50:43.707Z"}}