CVE-2026-91638 is a critical (CVSS 9.9) flaw in the Security component of Oracle Essbase 21.8.3.0.0. It lets a low-privileged attacker with HTTP network access take over the product.
What Is It
CVE-2026-91638 is a vulnerability in the Security component of Oracle Essbase. Oracle describes it as easily exploitable. An attacker needs network access over HTTP and only low privileges. No user interaction is required.
Oracle reported the issue, and NVD published it on 2026-10-20. NVD still lists the record as "Received," so it has not yet completed NVD analysis.
Why It Matters
Oracle scores the flaw CVSS 3.1 9.9 (Critical). The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. That means:
- Network-reachable with low attack complexity
- Low privileges required, and no user interaction
- Scope changed: the flaw is in Oracle Essbase, but Oracle warns that attacks may significantly affect other products
- High impact to confidentiality, integrity and availability
A successful attack can result in takeover of Oracle Essbase. Because only low privileges are required, any valid low-privileged account with HTTP access to Essbase could potentially give an attacker a path to full compromise. Because the scope changes, the damage could also spread past Essbase to connected systems.
Exploitation status: As of publication, CVE-2026-91638 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The source material does not confirm active exploitation in the wild, and no KEV remediation deadline applies.
What's Vulnerable
| Vendor | Product | Component | Affected Version |
|---|---|---|---|
| Oracle Corporation | Oracle Essbase | Security | 21.8.3.0.0 |
Oracle lists 21.8.3.0.0 as the supported version that is affected. The NVD record does not list any CPE entries yet.
Patch Status
The NVD record links to Oracle's October 2026 Critical Patch Update security alert. Organizations running Oracle Essbase 21.8.3.0.0 should:
- Read the Oracle October 2026 Critical Patch Update advisory and apply the fix it provides for Essbase.
- Make patching a high priority, given the 9.9 score, low attack complexity and scope change.
- Until the fix is applied, limit HTTP access to Essbase to trusted networks and check which accounts have access to Essbase.
The supplied data does not name a fixed version or a CISA required action.