CVE-2026-91662: Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Essbase executes to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as unauthorized update, insert or delete access t

This vulnerability (CVE-2026-91662) affects Oracle Essbase 21.8.3.0.0, specifically the Java Based Agent component. It is difficult to exploit and requires the attacker to have low privileged logon access to the infrastructure hosting Oracle Essbase. Exploitation can result in unauthorized access to critical data or complete access to all data accessible by Oracle Essbase, including unauthorized modification capabilities (update, insert, delete). The vulnerability impacts confidentiality and integrity with a CVSS 3.1 vector of AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N. The vulnerability also has a scope change, meaning it may affect other Oracle products indirectly. Oracle has included a fix for this vulnerability in their October 2026 Critical Patch Update, which contains 1295 security patches across multiple products.

Successful exploitation allows a low privileged attacker with infrastructure logon to gain unauthorized access to critical data or full access to all Oracle Essbase accessible data. The attacker can also perform unauthorized update, insert, or delete operations on some of the data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope change indicates potential impact on additional Oracle products beyond Essbase.

Oracle has released an official patch for this vulnerability as part of the October 2026 Critical Patch Update. Users of Oracle Essbase version 21.8.3.0.0 should apply the patch promptly to remediate this vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.