An easily exploitable flaw in the Security component of Oracle Essbase 21.8.3.0.0 lets an unauthenticated attacker with network access over HTTP compromise the product, and Oracle rates it CVSS 3.1 9.3 (Critical).
What Is It
CVE-2026-91644 is in the Security component of Oracle Essbase. Oracle reported it, and NVD published it on 2026-10-20. Its NVD status is "Received."
Oracle says the flaw is easily exploitable. An unauthenticated attacker who can reach Essbase over the network via HTTP can use it to compromise the product. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Scope: Changed
- Confidentiality: High
- Integrity: Low
- Availability: None
Why It Matters
The attacker needs no credentials and no user interaction, and the attack is low-complexity over HTTP. That puts Essbase 21.8.3.0.0 instances reachable over HTTP at particular risk. According to Oracle, a successful attack can give unauthorized access to critical data, or complete access to all data Essbase can reach. It can also allow unauthorized update, insert or delete access to some of that data.
The scope is marked "Changed." Oracle notes that although the flaw is in Essbase, attacks may significantly impact additional products. Essbase often holds financial and planning data, so the confidentiality impact is the main concern.
The CISA Known Exploited Vulnerabilities (KEV) catalog has no entry for this CVE. Active exploitation is not confirmed as of publication.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Essbase
- Component: Security
- Affected supported version: 21.8.3.0.0
The NVD record lists no CPE entries yet.
Patch Status
The NVD record points to Oracle's October 2026 Critical Patch Update (CPU) advisory as the vendor reference. Organizations running Oracle Essbase 21.8.3.0.0 should check that advisory for fix details and apply Oracle's guidance.
There is no CISA KEV entry, so no federal remediation deadline or required action applies. Until a patch is applied, limit HTTP access to Essbase to trusted networks to reduce exposure, given that no authentication is needed.