CVE-2026-91655 is a critical (CVSS 9.1) flaw in the Security component of Oracle Essbase 21.8.3.0.0 that lets a low-privileged attacker with network access over HTTP compromise Essbase and possibly affect other products.
What Is It
CVE-2026-91655 is a vulnerability in the Security component of Oracle Essbase. Oracle calls it "easily exploitable." An attacker needs only low privileges and network access via HTTP. No user interaction is required.
Oracle's description says a successful attack can lead to:
- Unauthorized access to critical data, or complete access to all data Essbase can reach
- Unauthorized update, insert or delete access to some of that data
- A partial denial of service (DoS) of Oracle Essbase
The flaw has a CVSS 3.1 base score of 9.1 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L.
Why It Matters
Several parts of the score make this worth prioritizing:
- Network-reachable, low complexity: The attack works over HTTP and needs no special conditions.
- Low privilege bar: Any authenticated low-privileged account may be enough.
- Scope change: Oracle says the vulnerability is in Essbase, but attacks "may significantly impact additional products." The impact can reach beyond Essbase itself.
- High confidentiality impact: Essbase often holds sensitive financial and analytical data. Complete read access to that data is a serious exposure.
CVE-2026-91655 does not currently appear in the CISA Known Exploited Vulnerabilities (KEV) Catalog. The supplied data does not confirm active exploitation. NVD lists the record as "Received," published 2026-10-20, so further analysis may follow.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Essbase
- Component: Security
- Affected supported version: 21.8.3.0.0
The NVD record lists no CPEs yet.
Patch Status
The only reference in the NVD record is Oracle's October 2026 Critical Patch Update (CPU) advisory. CISA has issued no required action, since there is no KEV entry. Organizations running Oracle Essbase 21.8.3.0.0 should:
- Review the October 2026 CPU advisory for fix and upgrade guidance specific to Essbase.
- Apply the remediation Oracle provides.
- Until then, limit HTTP access to Essbase to trusted networks and review low-privileged accounts.