CVE-2026-91637 is a critical (CVSS 9.9) flaw in the Security component of Oracle Essbase 21.8.3.0.0. A low-privileged attacker with network access over HTTP can exploit it easily to take over Essbase, and the impact can reach other products.
What Is It
CVE-2026-91637 is in the Security component of Oracle Essbase. Oracle calls it "easily exploitable." An attacker who has low privileges and network access via HTTP can use it to compromise Oracle Essbase. A successful attack can result in full takeover of the product.
Oracle rates it CVSS 3.1 base score 9.9 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. That means:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: Low
- User interaction: None
- Scope: Changed
- Impact: High confidentiality, integrity, and availability
NVD published the record on 2026-10-20 with status "Received," so NVD has not yet done its own analysis.
Why It Matters
Several factors make this flaw serious. It is reachable over the network, takes little effort to exploit, needs only low-level privileges and requires no user interaction. The scope change matters too. Oracle says that although the vulnerability is in Essbase, attacks "may significantly impact additional products," so a compromise may not stay inside Essbase. Essbase often sits close to financial and planning data, which raises the stakes of a full takeover.
Exploitation status: The supplied CISA Known Exploited Vulnerabilities (KEV) data has no entry for this CVE. The source material does not confirm active exploitation in the wild, and KEV gives no required action or federal remediation deadline.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Essbase
- Component: Security
- Affected supported version: 21.8.3.0.0
The NVD record lists no affected CPEs yet.
Patch Status
The only reference in the NVD record is Oracle's October 2026 Critical Patch Update advisory (cpuoct2026). Organizations running Oracle Essbase 21.8.3.0.0 should:
- Review that advisory for the fix and remediation guidance
- Apply the relevant Oracle patches as a priority, given the critical score and low barrier to exploitation
- Check exposure in any connected products, because the scope is changed
The supplied data contains no KEV-mandated required action or due date.
Sources
- NVD – CVE-2026-91637
- Oracle Critical Patch Update Advisory – October 2026
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE in the supplied data)