CVE-2026-91656 is a critical (CVSS 9.1) flaw in the Federated Partitions component of Oracle Essbase 21.8.3.0.0 that a low-privileged attacker can exploit over HTTP to reach critical data and affect other products.
What Is It
CVE-2026-91656 is a vulnerability in the Federated Partitions component of Oracle Essbase. Oracle submitted it, and NVD published it on 2026-10-20. Its NVD status is currently "Received."
Oracle calls it "easily exploitable." An attacker needs only low privileges and network access over HTTP. No user interaction is required. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L, with a base score of 9.1 (CRITICAL), an exploitability subscore of 3.1 and an impact subscore of 5.3.
Why It Matters
The scope is Changed. That means a successful attack on Essbase may also significantly impact other products. According to Oracle's description, a successful exploit can result in:
- Unauthorized access to critical data, or complete access to all data Oracle Essbase can reach (High confidentiality impact)
- Unauthorized update, insert or delete access to some Essbase-accessible data (Low integrity impact)
- Partial denial of service of Oracle Essbase (Low availability impact)
The bar for exploitation is low: network reachable, low complexity, only low privileges and no user interaction. Any authenticated foothold on an exposed Essbase instance could be enough to reach high-value data.
Exploitation status: CVE-2026-91656 is not currently in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation. The supplied sources also do not mention any public exploit or in-the-wild activity.
What's Vulnerable
| Vendor | Product | Component | Affected Version |
|---|---|---|---|
| Oracle Corporation | Oracle Essbase | Federated Partitions | 21.8.3.0.0 |
Oracle lists 21.8.3.0.0 as the supported version that is affected. The NVD record has no CPE entries yet.
Patch Status
Oracle covers this vulnerability in its October 2026 Critical Patch Update (CPU). Administrators running Oracle Essbase 21.8.3.0.0 should:
- Review the October 2026 CPU advisory for the fix and patch details for Essbase.
- Apply the Oracle-supplied update as soon as possible, putting internet-reachable or broadly accessible Essbase deployments first.
- Until patched, limit HTTP access to Essbase to trusted users and networks, and review which accounts hold low-privilege access.
There is no CISA KEV entry, so no federal required action or due date applies at this time.
Sources
- Oracle Critical Patch Update Advisory – October 2026
- NVD – CVE-2026-91656
- CISA Known Exploited Vulnerabilities Catalog (CVE-2026-91656 is not listed)