CVE-2026-91642 is a high-severity vulnerability in Oracle Essbase version 21.8.3.0.0 that allows an unauthenticated attacker with network access via HTTP to compromise the system. Exploitation can lead to unauthorized read, update, insert, or delete access to some Oracle Essbase data and can cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 7.3, indicating significant confidentiality, integrity, and availability impacts. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous security patches across multiple products. Customers are strongly advised to apply the relevant patches promptly to mitigate the risk.
CVE-2026-91641 is a vulnerability in Oracle Essbase version 21.8.3.0.0 that allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some Oracle Essbase data. The vulnerability has a CVSS 3.1 base score of 5.0, indicating a medium severity impact primarily on confidentiality. The vulnerability also has a scope change, potentially affecting additional Oracle products. Oracle has released a Critical Patch Update advisory that includes patches for this and many other vulnerabilities.
CVE-2026-91640 is a vulnerability in Oracle Essbase version 21.8.3.0.0 that allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some Oracle Essbase data. The vulnerability impacts confidentiality but does not affect integrity or availability. The vulnerability has a CVSS 3.1 base score of 5.0 (medium severity). Oracle has published a Critical Patch Update advisory that includes patches for this and many other vulnerabilities.
CVE-2026-91639 is a vulnerability in Oracle Essbase version 21.8.3.0.0 that allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Essbase. The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity, with a confidentiality impact but no integrity or availability impact. The vulnerability also has scope change potential, affecting additional Oracle products indirectly. Oracle has released a Critical Patch Update in October 2026 addressing this and many other vulnerabilities, and strongly recommends applying patches promptly.
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVE-2026-91636 is a high-severity vulnerability in Oracle Essbase version 21.8.3.0.0 that allows a low privileged attacker with network access via HTTP to compromise the product. The vulnerability affects the security component and can lead to unauthorized access to critical or all accessible data within Oracle Essbase. The vulnerability has a CVSS 3.1 base score of 7.7, indicating significant confidentiality impact without affecting integrity or availability. The vulnerability also has scope change implications, potentially impacting additional Oracle products. Oracle has released a Critical Patch Update in October 2026 addressing this and many other vulnerabilities, and customers are strongly advised to apply patches promptly.
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-91634 is a medium severity vulnerability in Oracle Essbase version 21.8.3.0.0. It allows an unauthenticated attacker with network access via T3 or IIOP protocols to gain unauthorized read access to some data accessible by Oracle Essbase. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a confidentiality impact without integrity or availability effects. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, recommending customers apply patches promptly.
CVE-2026-91633 is a vulnerability in Oracle Essbase version 21.8.3.0.0 that allows a high privileged attacker with logon access to the infrastructure where Oracle Essbase runs to compromise the product. Successful exploitation can lead to unauthorized access to critical data or full access to all data accessible by Oracle Essbase. The vulnerability has a CVSS 3.1 base score of 6.0, indicating a medium severity with significant confidentiality impact. Oracle has released a Critical Patch Update in October 2026 addressing this and many other vulnerabilities.
CVE-2026-91632 is a vulnerability in Oracle Essbase version 21.8.3.0.0 that allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Essbase. The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity with significant confidentiality impact. Oracle has published a Critical Patch Update advisory addressing this and many other vulnerabilities.
CVE-2026-91631 is a vulnerability in Oracle Essbase version 21.8.3.0.0 that allows a low privileged attacker with network access via HTTP to gain unauthorized read access to a subset of data accessible by Oracle Essbase. The vulnerability impacts confidentiality but does not affect integrity or availability. The vulnerability has a CVSS 3.1 base score of 5.0, indicating medium severity. Attacks exploiting this vulnerability may also affect additional Oracle products due to scope change. Oracle has released a Critical Patch Update in October 2026 addressing this and many other vulnerabilities.
CVE-2026-91630 is a vulnerability in Oracle Essbase version 21.8.3.0.0 affecting the Security component. It allows a high privileged attacker with network access via HTTP to compromise Oracle Essbase, potentially leading to unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 base score of 6.8, indicating a medium severity with significant confidentiality impact. The vulnerability also has scope change implications, potentially affecting additional Oracle products. Oracle has released a Critical Patch Update addressing this and many other vulnerabilities.
CVE-2026-91629 is a vulnerability in Oracle Communications Billing and Revenue Management versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0. It allows a low privileged attacker with logon access to the infrastructure to compromise the product, potentially gaining unauthorized access to critical or all accessible data. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.7, primarily impacting confidentiality. Exploitation is difficult and requires high attack complexity. Oracle has released patches as part of their October 2026 Critical Patch Update.
CVE-2026-91628 is a vulnerability in Oracle Communications Billing and Revenue Management (BRM) versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0. It allows a low privileged attacker with logon access to the infrastructure to compromise the BRM system, potentially gaining unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 base score of 5.5, indicating a medium severity with high confidentiality impact but no integrity or availability impact. Oracle has released patches for this and many other vulnerabilities in its October 2026 Critical Patch Update advisory.
CVE-2026-91627 is a high-severity vulnerability in Oracle Communications Billing and Revenue Management (versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0). It allows a low privileged attacker with logon access to the infrastructure to fully compromise the product, potentially leading to complete takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 7.8. Oracle has published a Critical Patch Update advisory addressing this and many other vulnerabilities, recommending timely patching. No known exploits in the wild have been reported yet.
CVE-2026-91625 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data and perform unauthorized update, insert, or delete operations on some accessible data. The vulnerability has a CVSS 3.1 base score of 8.2, indicating significant confidentiality and integrity impacts. Oracle has acknowledged this vulnerability in its October 2026 Critical Patch Update advisory and recommends applying security patches promptly.
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVE-2026-91623 is a vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows an unauthenticated attacker with network access via HTTP to potentially compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, resulting in high confidentiality and integrity impacts. The vulnerability is rated with a CVSS 3.1 base score of 7.4, indicating high severity. Oracle has included this vulnerability in its October 2026 Critical Patch Update, which provides patches for affected products.
CVE-2026-91622 is a critical vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows an unauthenticated attacker with network access via HTTP to compromise the product. Successful exploitation requires human interaction from a user other than the attacker and can lead to unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to all accessible data. The vulnerability has a CVSS 3.1 base score of 9.3, indicating high confidentiality and integrity impacts. Oracle has released patches addressing this vulnerability as part of their October 2026 Critical Patch Update.