CVE-2026-114820 is a critical vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition affecting the JSSE component. It allows an unauthenticated attacker with network access via multiple protocols to compromise the affected products. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data accessible by these products. The vulnerability can be exploited through APIs, including web services, and affects Java deployments running sandboxed Java Web Start applications or applets that load untrusted code. The CVSS 3.1 base score is 9.1, indicating high confidentiality and integrity impact without availability impact. Oracle has released updates that remove impacted root CA certificates related to eMudhra to address this issue.
CVE-2026-91403 is a critical vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition affecting the JSSE component. It allows an unauthenticated attacker with network access via multiple protocols to compromise the affected products. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to all accessible data. The vulnerability can be exploited through APIs, including web services, and affects Java deployments running sandboxed Java Web Start applications or applets that load untrusted code. The CVSS 3.1 base score is 9.1, indicating a high severity. Oracle has released updates that distrust impacted intermediate CA certificates related to eMudhra to address this issue. Users are advised to update to the latest Java versions or apply recommended mitigations from Oracle's advisory.
CVE-2026-91668 is a high-severity vulnerability in Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access to exploit SQL to compromise the product, potentially resulting in full takeover. The vulnerability affects confidentiality, integrity, and availability with a CVSS 3.1 base score of 8.8. Oracle has released patches for this and many other vulnerabilities in their October 2026 Critical Patch Update advisory.
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Essbase. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVE-2026-91662 is a vulnerability in Oracle Essbase version 21.8.3.0.0 affecting the Java Based Agent component. It allows a low privileged attacker with logon access to the infrastructure where Oracle Essbase runs to compromise the product. Successful exploitation can lead to unauthorized access to critical data or full access to all data accessible by Oracle Essbase, including unauthorized update, insert, or delete operations. The vulnerability has a CVSS 3.1 base score of 6.4, indicating a medium severity level. The vulnerability also has scope change, potentially impacting additional Oracle products. Oracle has released patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update.
CVE-2026-91661 is a vulnerability in Oracle Essbase version 21.8.3.0.0 that allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Essbase. The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity with significant confidentiality impact. The vulnerability also has scope change potential, affecting additional Oracle products. Oracle has released a Critical Patch Update in October 2026 that addresses this and many other vulnerabilities.
CVE-2026-91660 is a vulnerability in Oracle Essbase version 21.8.3.0.0 that allows a low privileged attacker with network access via HTTP to cause a partial denial of service. The vulnerability impacts availability but does not affect confidentiality or integrity. The CVSS 3.1 base score is 4.3, indicating a medium severity. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.
CVE-2026-91659 is a vulnerability in Oracle Essbase Build component version 21.8.3.0.0 that allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Essbase. The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity with a significant confidentiality impact. Oracle has published a Critical Patch Update advisory addressing multiple vulnerabilities, including this one.
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVE-2026-91657 is a vulnerability in Oracle Essbase version 21.8.3.0.0 affecting the Security component. It allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some Oracle Essbase accessible data. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity impact focused on confidentiality. Oracle has published a Critical Patch Update advisory in October 2026 that includes security patches for multiple products including Oracle Essbase. The advisory strongly recommends applying available patches promptly to mitigate exploitation risks.
CVE-2026-91656 is a critical vulnerability in Oracle Essbase version 21.8.3.0.0 affecting the Federated Partitions component. It allows a low privileged attacker with network access via HTTP to compromise the system, potentially leading to unauthorized access to critical data, unauthorized data modification, and partial denial of service. The vulnerability has a CVSS 3.1 base score of 9.1, indicating high severity with significant confidentiality, integrity, and availability impacts. Oracle has released patches addressing this and other vulnerabilities in their October 2026 Critical Patch Update.
CVE-2026-91655 is a critical vulnerability in Oracle Essbase version 21.8.3.0.0 that allows a low privileged attacker with network access via HTTP to compromise the system. Exploitation can lead to unauthorized access to critical data, unauthorized modification (update, insert, delete) of some data, and partial denial of service. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 9.1. Oracle has released patches for this and other vulnerabilities in their October 2026 Critical Patch Update.
CVE-2026-91654 is a vulnerability in Oracle Essbase version 21.8.3.0.0 that allows a low privileged attacker with network access via HTTP to perform unauthorized read, update, insert, or delete operations on some accessible data. It also enables the attacker to cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 6.3, indicating a medium severity level.
CVE-2026-91653 is a high-severity vulnerability in Oracle Essbase Web Platform version 21.8.3.0.0. It allows a low privileged attacker with network access via HTTP to compromise Oracle Essbase, potentially leading to unauthorized access to critical data and unauthorized modification (update, insert, delete) of some data. The vulnerability has a CVSS 3.1 base score of 8.5, indicating significant confidentiality and integrity impacts with no availability impact. Oracle has published a Critical Patch Update advisory that includes patches for multiple vulnerabilities, including this one.
CVE-2026-91652 is a vulnerability in Oracle Essbase version 21.8.3.0.0 that allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some Oracle Essbase data. The vulnerability impacts confidentiality but does not affect integrity or availability. The vulnerability has a CVSS 3.1 base score of 5.0, indicating a medium severity. Oracle has published a Critical Patch Update advisory that includes patches for multiple vulnerabilities, including this one.
Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVE-2026-91650 is a vulnerability in Oracle Essbase version 21.8.3.0.0 affecting the Java Based Agent component. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to some Oracle Essbase data. The vulnerability is rated as low severity with a CVSS 3.1 base score of 3.7, reflecting limited confidentiality impact and no impact on integrity or availability.
CVE-2026-91649 is a vulnerability in Oracle Essbase version 21.8.3.0.0 affecting the Java Based Agent component. It allows a high privileged attacker with logon access to the infrastructure where Oracle Essbase runs to compromise the product. Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle Essbase. The vulnerability has a CVSS 3.1 base score of 6.0, indicating a medium severity with high confidentiality impact but no integrity or availability impact. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.