A critical (CVSS 9.9) vulnerability in the Security component of Oracle Essbase 21.8.3.0.0 lets a low-privileged attacker with network access over HTTP take over the product.
What Is It
CVE-2026-91658 is a vulnerability in the Security component of Oracle Essbase. Oracle reported it, and NVD published it on October 20, 2026. Its NVD status is currently "Received." Oracle calls the flaw "easily exploitable." An attacker needs network access over HTTP and only low privileges to compromise Oracle Essbase. No user interaction is required.
Oracle scores it CVSS 3.1 9.9 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The breakdown:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Changed
- Confidentiality / Integrity / Availability: High / High / High
Why It Matters
A successful attack can result in takeover of Oracle Essbase. The scope is "changed," meaning the flaw is in Essbase but Oracle warns that attacks "may significantly impact additional products." An attacker who takes over Essbase may be able to reach or damage the systems that connect to it or depend on it.
The flaw has low attack complexity, needs no user interaction and only requires a low-privileged account. Any authenticated user who can reach the HTTP interface is a possible attacker. Until the patch is in place, anyone with a basic Essbase login and network access to it could take over the server, read or change its data, or shut it down.
As of this writing, this CVE has no entry in the CISA Known Exploited Vulnerabilities (KEV) catalog. Active exploitation has not been confirmed in the supplied data.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Essbase
- Component: Security
- Affected version: 21.8.3.0.0
Oracle lists 21.8.3.0.0 as the supported affected version. The supplied record lists no CPE entries.
Patch Status
The NVD record cites Oracle's October 2026 Critical Patch Update advisory (cpuoct2026) as its reference. Organizations running Oracle Essbase 21.8.3.0.0 should review that advisory and apply Oracle's remediation for this CVE. The supplied data does not name a fixed version.
The CVE does not appear in the CISA KEV catalog, so no CISA-mandated required action or due date applies at this time. Until patches are applied, consider limiting HTTP access to Essbase and reviewing which accounts have low-privileged access.