---
id: "CVE-2026-91633"
kind: "vulnerability"
aliases: ["CVE-2026-91633"]
title: "Oracle Essbase: local high-privilege attacker can read critical data"
severity: "medium"
cvss: 6.0
epss: 0.00127
exploited: false
status: "open"
category: "vendor"
products: [{"name": "oracle essbase", "fixed": [], "affected": "= 21.8.3.0.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["on-prem-analytics", "oracle-essbase", "vendor"]
not_affected_if: ["no-local-logon-exposure", "not-essbase-21.8.3.0.0"]
published_at: "2026-10-20T22:21:03+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T04:05:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91633", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91633", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Oracle Essbase: local high-privilege attacker can read critical data

Oracle Essbase 21.8.3.0.0 has a flaw in its Security component that lets an attacker who already has logon on the host where Essbase runs reach Essbase data they should not see. Per the CVSS vector, the attacker needs high privileges and the impact is to confidentiality, with a scope change to other products.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:oracle essbase affected = 21.8.3.0.0 fixed ?

## How to check

- Confirm the installed Essbase version against `21.8.3.0.0` in the Oracle Essbase server configuration or install directory
- unknown for other checks; the sources do not list them

## Fix

- Move Essbase to a patched release from Oracle's Critical Patch Update advisory; the fixed version is unknown in the sources

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91633
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91633

## From the sources

Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Essbase executes to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_