CVE-2026-91662 is a vulnerability in Oracle Essbase version 21.8.3.0.0 affecting the Java Based Agent component. It allows a low privileged attacker with logon access to the infrastructure where Oracle Essbase runs to compromise the product. Successful exploitation can lead to unauthorized access to critical data or full access to all data accessible by Oracle Essbase, including unauthorized update, insert, or delete operations. The vulnerability has a CVSS 3.1 base score of 6.4, indicating a medium severity level. The vulnerability also has scope change, potentially impacting additional Oracle products. Oracle has released patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update.
CVE-2026-91661 is a vulnerability in Oracle Essbase version 21.8.3.0.0 that allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Essbase. The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity with significant confidentiality impact. The vulnerability also has scope change potential, affecting additional Oracle products. Oracle has released a Critical Patch Update in October 2026 that addresses this and many other vulnerabilities.
CVE-2026-91660 is a vulnerability in Oracle Essbase version 21.8.3.0.0 that allows a low privileged attacker with network access via HTTP to cause a partial denial of service. The vulnerability impacts availability but does not affect confidentiality or integrity. The CVSS 3.1 base score is 4.3, indicating a medium severity. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.
CVE-2026-91659 is a vulnerability in Oracle Essbase Build component version 21.8.3.0.0 that allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Essbase. The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity with a significant confidentiality impact. Oracle has published a Critical Patch Update advisory addressing multiple vulnerabilities, including this one.
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVE-2026-91657 is a vulnerability in Oracle Essbase version 21.8.3.0.0 affecting the Security component. It allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some Oracle Essbase accessible data. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity impact focused on confidentiality. Oracle has published a Critical Patch Update advisory in October 2026 that includes security patches for multiple products including Oracle Essbase. The advisory strongly recommends applying available patches promptly to mitigate exploitation risks.
CVE-2026-91656 is a critical vulnerability in Oracle Essbase version 21.8.3.0.0 affecting the Federated Partitions component. It allows a low privileged attacker with network access via HTTP to compromise the system, potentially leading to unauthorized access to critical data, unauthorized data modification, and partial denial of service. The vulnerability has a CVSS 3.1 base score of 9.1, indicating high severity with significant confidentiality, integrity, and availability impacts. Oracle has released patches addressing this and other vulnerabilities in their October 2026 Critical Patch Update.
CVE-2026-91655 is a critical vulnerability in Oracle Essbase version 21.8.3.0.0 that allows a low privileged attacker with network access via HTTP to compromise the system. Exploitation can lead to unauthorized access to critical data, unauthorized modification (update, insert, delete) of some data, and partial denial of service. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 9.1. Oracle has released patches for this and other vulnerabilities in their October 2026 Critical Patch Update.
CVE-2026-91654 is a vulnerability in Oracle Essbase version 21.8.3.0.0 that allows a low privileged attacker with network access via HTTP to perform unauthorized read, update, insert, or delete operations on some accessible data. It also enables the attacker to cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 6.3, indicating a medium severity level.
CVE-2026-91653 is a high-severity vulnerability in Oracle Essbase Web Platform version 21.8.3.0.0. It allows a low privileged attacker with network access via HTTP to compromise Oracle Essbase, potentially leading to unauthorized access to critical data and unauthorized modification (update, insert, delete) of some data. The vulnerability has a CVSS 3.1 base score of 8.5, indicating significant confidentiality and integrity impacts with no availability impact. Oracle has published a Critical Patch Update advisory that includes patches for multiple vulnerabilities, including this one.
CVE-2026-91652 is a vulnerability in Oracle Essbase version 21.8.3.0.0 that allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some Oracle Essbase data. The vulnerability impacts confidentiality but does not affect integrity or availability. The vulnerability has a CVSS 3.1 base score of 5.0, indicating a medium severity. Oracle has published a Critical Patch Update advisory that includes patches for multiple vulnerabilities, including this one.
Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVE-2026-91650 is a vulnerability in Oracle Essbase version 21.8.3.0.0 affecting the Java Based Agent component. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to some Oracle Essbase data. The vulnerability is rated as low severity with a CVSS 3.1 base score of 3.7, reflecting limited confidentiality impact and no impact on integrity or availability.
CVE-2026-91649 is a vulnerability in Oracle Essbase version 21.8.3.0.0 affecting the Java Based Agent component. It allows a high privileged attacker with logon access to the infrastructure where Oracle Essbase runs to compromise the product. Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle Essbase. The vulnerability has a CVSS 3.1 base score of 6.0, indicating a medium severity with high confidentiality impact but no integrity or availability impact. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.
CVE-2026-91648 is a vulnerability in Oracle Essbase version 21.8.3.0.0 affecting the Java Based Agent component. It allows an unauthenticated attacker with network access via TCP to gain unauthorized read access to some Oracle Essbase data. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact focused on confidentiality. Oracle has published a Critical Patch Update advisory that includes patches for this and many other vulnerabilities.
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-91646 is a vulnerability in Oracle Essbase version 21.8.3.0.0 affecting the Security component. It allows an unauthenticated attacker with network access via T3 or IIOP protocols to perform unauthorized update, insert, or delete operations on some accessible data, read a subset of data, and cause a partial denial of service. The vulnerability is rated medium severity with a CVSS 3.1 base score of 5.6.
CVE-2026-91645 is a vulnerability in Oracle Essbase version 21.8.3.0.0 that allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to some Oracle Essbase data. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact focused on confidentiality. Oracle has published a Critical Patch Update advisory that includes patches for this and many other vulnerabilities. Customers are strongly advised to apply the available security patches promptly.
CVE-2026-91644 is a critical vulnerability in Oracle Essbase version 21.8.3.0.0 that allows an unauthenticated attacker with network access via HTTP to compromise the system. Exploitation can lead to unauthorized access to critical data or full access to all data accessible by Oracle Essbase, including unauthorized update, insert, or delete operations on some data. The vulnerability has a CVSS 3.1 base score of 9.3, indicating high confidentiality and integrity impacts with no availability impact. Oracle has released patches addressing this vulnerability as part of its October 2026 Critical Patch Update. Users are strongly advised to apply the available security patches promptly to mitigate the risk.
CVE-2026-91643 is a vulnerability in Oracle Essbase version 21.8.3.0.0 affecting the Java Based Agent component. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to a subset of data accessible by Oracle Essbase. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact focused on confidentiality. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.