Live › vulnerability › CVE-2026-91633
Go to dashboardOracle Essbase 21.8.3.0.0 has a flaw in its Security component that lets an attacker who already has logon on the host where Essbase runs reach Essbase data they should not see. Per the CVSS vector, the attacker needs high privileges and the impact is to confidentiality, with a scope change to other products.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only deployments of Oracle Essbase 21.8.3.0.0 are named as affected. Exposure requires an attacker with high privileges and logon to the infrastructure where Essbase runs, so hosts without local user access are lower risk. Teams not running Essbase can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| oracle essbase | vendor | = 21.8.3.0.0 | – |
21.8.3.0.0 in the Oracle Essbase server configuration or install directoryEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Essbase executes to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-91633")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.