CVE-2026-91648 is a vulnerability in Oracle Essbase version 21.8.3.0.0 affecting the Java Based Agent component. It allows an unauthenticated attacker with network access via TCP to gain unauthorized read access to some Oracle Essbase data. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact focused on confidentiality. Oracle has published a Critical Patch Update advisory that includes patches for this and many other vulnerabilities.
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-91646 is a vulnerability in Oracle Essbase version 21.8.3.0.0 affecting the Security component. It allows an unauthenticated attacker with network access via T3 or IIOP protocols to perform unauthorized update, insert, or delete operations on some accessible data, read a subset of data, and cause a partial denial of service. The vulnerability is rated medium severity with a CVSS 3.1 base score of 5.6.
CVE-2026-91645 is a vulnerability in Oracle Essbase version 21.8.3.0.0 that allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to some Oracle Essbase data. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact focused on confidentiality. Oracle has published a Critical Patch Update advisory that includes patches for this and many other vulnerabilities. Customers are strongly advised to apply the available security patches promptly.
CVE-2026-91644 is a critical vulnerability in Oracle Essbase version 21.8.3.0.0 that allows an unauthenticated attacker with network access via HTTP to compromise the system. Exploitation can lead to unauthorized access to critical data or full access to all data accessible by Oracle Essbase, including unauthorized update, insert, or delete operations on some data. The vulnerability has a CVSS 3.1 base score of 9.3, indicating high confidentiality and integrity impacts with no availability impact. Oracle has released patches addressing this vulnerability as part of its October 2026 Critical Patch Update. Users are strongly advised to apply the available security patches promptly to mitigate the risk.
CVE-2026-91643 is a vulnerability in Oracle Essbase version 21.8.3.0.0 affecting the Java Based Agent component. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to a subset of data accessible by Oracle Essbase. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact focused on confidentiality. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.
CVE-2026-91642 is a high-severity vulnerability in Oracle Essbase version 21.8.3.0.0 that allows an unauthenticated attacker with network access via HTTP to compromise the system. Exploitation can lead to unauthorized read, update, insert, or delete access to some Oracle Essbase data and can cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 7.3, indicating significant confidentiality, integrity, and availability impacts. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous security patches across multiple products. Customers are strongly advised to apply the relevant patches promptly to mitigate the risk.
CVE-2026-91641 is a vulnerability in Oracle Essbase version 21.8.3.0.0 that allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some Oracle Essbase data. The vulnerability has a CVSS 3.1 base score of 5.0, indicating a medium severity impact primarily on confidentiality. The vulnerability also has a scope change, potentially affecting additional Oracle products. Oracle has released a Critical Patch Update advisory that includes patches for this and many other vulnerabilities.
CVE-2026-91640 is a vulnerability in Oracle Essbase version 21.8.3.0.0 that allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some Oracle Essbase data. The vulnerability impacts confidentiality but does not affect integrity or availability. The vulnerability has a CVSS 3.1 base score of 5.0 (medium severity). Oracle has published a Critical Patch Update advisory that includes patches for this and many other vulnerabilities.
CVE-2026-91639 is a vulnerability in Oracle Essbase version 21.8.3.0.0 that allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Essbase. The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity, with a confidentiality impact but no integrity or availability impact. The vulnerability also has scope change potential, affecting additional Oracle products indirectly. Oracle has released a Critical Patch Update in October 2026 addressing this and many other vulnerabilities, and strongly recommends applying patches promptly.
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVE-2026-91636 is a high-severity vulnerability in Oracle Essbase version 21.8.3.0.0 that allows a low privileged attacker with network access via HTTP to compromise the product. The vulnerability affects the security component and can lead to unauthorized access to critical or all accessible data within Oracle Essbase. The vulnerability has a CVSS 3.1 base score of 7.7, indicating significant confidentiality impact without affecting integrity or availability. The vulnerability also has scope change implications, potentially impacting additional Oracle products. Oracle has released a Critical Patch Update in October 2026 addressing this and many other vulnerabilities, and customers are strongly advised to apply patches promptly.
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-91634 is a medium severity vulnerability in Oracle Essbase version 21.8.3.0.0. It allows an unauthenticated attacker with network access via T3 or IIOP protocols to gain unauthorized read access to some data accessible by Oracle Essbase. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a confidentiality impact without integrity or availability effects. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, recommending customers apply patches promptly.
CVE-2026-91633 is a vulnerability in Oracle Essbase version 21.8.3.0.0 that allows a high privileged attacker with logon access to the infrastructure where Oracle Essbase runs to compromise the product. Successful exploitation can lead to unauthorized access to critical data or full access to all data accessible by Oracle Essbase. The vulnerability has a CVSS 3.1 base score of 6.0, indicating a medium severity with significant confidentiality impact. Oracle has released a Critical Patch Update in October 2026 addressing this and many other vulnerabilities.
CVE-2026-91632 is a vulnerability in Oracle Essbase version 21.8.3.0.0 that allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Essbase. The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity with significant confidentiality impact. Oracle has published a Critical Patch Update advisory addressing this and many other vulnerabilities.
CVE-2026-91631 is a vulnerability in Oracle Essbase version 21.8.3.0.0 that allows a low privileged attacker with network access via HTTP to gain unauthorized read access to a subset of data accessible by Oracle Essbase. The vulnerability impacts confidentiality but does not affect integrity or availability. The vulnerability has a CVSS 3.1 base score of 5.0, indicating medium severity. Attacks exploiting this vulnerability may also affect additional Oracle products due to scope change. Oracle has released a Critical Patch Update in October 2026 addressing this and many other vulnerabilities.
CVE-2026-91630 is a vulnerability in Oracle Essbase version 21.8.3.0.0 affecting the Security component. It allows a high privileged attacker with network access via HTTP to compromise Oracle Essbase, potentially leading to unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 base score of 6.8, indicating a medium severity with significant confidentiality impact. The vulnerability also has scope change implications, potentially affecting additional Oracle products. Oracle has released a Critical Patch Update addressing this and many other vulnerabilities.
CVE-2026-91629 is a vulnerability in Oracle Communications Billing and Revenue Management versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0. It allows a low privileged attacker with logon access to the infrastructure to compromise the product, potentially gaining unauthorized access to critical or all accessible data. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.7, primarily impacting confidentiality. Exploitation is difficult and requires high attack complexity. Oracle has released patches as part of their October 2026 Critical Patch Update.