{"id":"CVE-2026-91633","kind":"vulnerability","aliases":["CVE-2026-91633"],"related":[],"title":"Oracle Essbase: local high-privilege attacker can read critical data","description":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Essbase executes to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).","summary":"Oracle Essbase 21.8.3.0.0 has a flaw in its Security component that lets an attacker who already has logon on the host where Essbase runs reach Essbase data they should not see. Per the CVSS vector, the attacker needs high privileges and the impact is to confidentiality, with a scope change to other products.","severity":"medium","cvss":6.0,"epss":0.00127,"exploited":false,"exploited_at":null,"products":[{"name":"oracle essbase","fixed":[],"affected":"= 21.8.3.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["on-prem-analytics","oracle-essbase","vendor"],"not_affected_if":["no-local-logon-exposure","not-essbase-21.8.3.0.0"],"how_to_check":"- Confirm the installed Essbase version against `21.8.3.0.0` in the Oracle Essbase server configuration or install directory\n- unknown for other checks; the sources do not list them","fix":"- Move Essbase to a patched release from Oracle's Critical Patch Update advisory; the fixed version is unknown in the sources","status":"open","published_at":"2026-10-20T22:21:03+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T04:05:35+00:00","updated_at":"2026-10-25T04:05:35+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:05:35Z","model":"claude-haiku-5-5","output":{"fix":"- Move Essbase to a patched release from Oracle's Critical Patch Update advisory; the fixed version is unknown in the sources","reach":"local","title":"Oracle Essbase: local high-privilege attacker can read critical data","impact":"medium","summary":"Oracle Essbase 21.8.3.0.0 has a flaw in its Security component that lets an attacker who already has logon on the host where Essbase runs reach Essbase data they should not see. Per the CVSS vector, the attacker needs high privileges and the impact is to confidentiality, with a scope change to other products.","category":"vendor","nicknames":[],"who_cares":["oracle-essbase","on-prem-analytics"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads critical Essbase data and affects other products","analyst_note":"Find the fixed Essbase version and the Oracle CPU advisory entry for CVE-2026-91633 to fill fix and how_to_check.","how_to_check":"- Confirm the installed Essbase version against `21.8.3.0.0` in the Oracle Essbase server configuration or install directory\n- unknown for other checks; the sources do not list them","needs_analyst":true,"not_affected_if":["not-essbase-21.8.3.0.0","no-local-logon-exposure"],"who_is_affected":"Only deployments of Oracle Essbase 21.8.3.0.0 are named as affected. Exposure requires an attacker with high privileges and logon to the infrastructure where Essbase runs, so hosts without local user access are lower risk. Teams not running Essbase can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00065,"input_tokens":3533,"output_tokens":593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-91633':14A,17A '/av':163C '21.8.3.0.0':30B,94C '3.1':153C,162C '6.0':156C 'access':139C,145C,150C 'addit':126C 'affect':92C 'allow':98C 'alreadi':43B 'analyt':23B 'attack':7A,41B,64B,101C,122C,131C 'base':154C 'c/c':168C 'chang':77B,129C 'complet':144C 'compon':37B,85C 'compromis':112C 'confidenti':73B,157C 'critic':10A,141C 'cve':12A,15A 'cvss':61B,152C,159C,161C 'data':11A,54B,142C,151C 'easili':95C 'essbas':2A,26B,29B,50B,53B,84C,109C,114C,121C,149C 'essbase':19A 'execut':110C 'exploit':96C 'flaw':33B 'h/i':169C 'h/ui':166C 'high':5A,66B,99C 'high-privileg':4A 'host':48B 'impact':70B,125C,158C 'infrastructur':106C 'l/ac':164C 'l/pr':165C 'let':39B 'local':3A 'logon':45B,103C 'may':123C 'n':171C 'n/a':170C 'n/s':167C 'need':65B 'on-prem-analyt':20B 'oracl':1A,25B,28B,83C,108C,113C,120C,148C 'oracle':18A 'oracle-essbas':24B 'per':59B 'prem':22B 'privileg':6A,67B,100C 'product':80B,127C 'reach':52B 'read':9A 'result':136C 'run':51B 'scope':76B,128C 'score':155C 'secur':36B,86C 'see':58B 'signific':124C 'success':130C 'support':88C 'unauthor':138C 'vector':62B,160C 'vendor':27B 'version':89C 'vulner':81C,97C,117C,134C","nicknames":[],"mitigations":[],"who_affected":"Only deployments of Oracle Essbase 21.8.3.0.0 are named as affected. Exposure requires an attacker with high privileges and logon to the infrastructure where Essbase runs, so hosts without local user access are lower risk. Teams not running Essbase can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:21:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91633","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91633","severity":null,"published_at":"2026-10-20T22:21:03+00:00","modified_at":"2026-10-23T17:19:37+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91633","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91633","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}