CVE-2026-91657: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. in Oracle Corporation Oracle Essbase

This vulnerability in Oracle Essbase (Security component) version 21.8.3.0.0 allows an attacker with low privileges and network access over HTTP to compromise the system by gaining unauthorized read access to a subset of data accessible through Oracle Essbase. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, reflecting network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, and limited confidentiality impact. Oracle's October 2026 Critical Patch Update advisory includes patches addressing this and many other vulnerabilities, emphasizing the importance of applying these updates to prevent exploitation.

Successful exploitation results in unauthorized read access to some Oracle Essbase accessible data, impacting confidentiality but not integrity or availability. The attack requires network access via HTTP and low privileges, making it moderately accessible to attackers. There are no known exploits in the wild at this time.

Oracle has released security patches for this vulnerability as part of the October 2026 Critical Patch Update. Customers are strongly advised to apply the relevant patches for Oracle Essbase version 21.8.3.0.0 without delay. Staying on actively supported versions and timely patching are the primary mitigations. No additional vendor-recommended mitigations are specified.