CVE-2026-91642: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Essbase accessible data as well as unauthorized read access to a subset of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. in Oracle Corporation Oracle Essbase

This vulnerability affects the Security component of Oracle Essbase version 21.8.3.0.0. It is easily exploitable by unauthenticated attackers over HTTP, enabling unauthorized modification and disclosure of accessible data and causing partial denial of service conditions. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) reflects network attack vector with low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. Oracle's October 2026 Critical Patch Update advisory includes patches addressing this vulnerability among 1295 security fixes. The advisory emphasizes the importance of applying patches without delay to prevent exploitation.

Successful exploitation allows an unauthenticated remote attacker to gain unauthorized read and write access to some Oracle Essbase data and to cause a partial denial of service, impacting confidentiality, integrity, and availability of the affected system.

Oracle has released security patches for this vulnerability as part of the October 2026 Critical Patch Update. Customers should apply the official Oracle patches for Oracle Essbase version 21.8.3.0.0 promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation.