{"id":"CVE-2026-91637","kind":"vulnerability","aliases":["CVE-2026-91637"],"related":[],"title":"Oracle Essbase: low-privilege network attacker can take over server","description":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","summary":"Oracle Essbase 21.8.3.0.0 has a flaw in its Security component. A low-privilege account can reach it over HTTP and take over the server, with impact on other products (CVSS 9.9). Oracle fixed it in the October 2026 CPU. Oracle's public page names no fixed version.","severity":"critical","cvss":9.9,"epss":0.00286,"exploited":false,"exploited_at":null,"products":[{"name":"oracle essbase","fixed":[],"affected":"= 21.8.3.0.0","ecosystem":"vendor"},{"name":"oracle essbase","fixed":[],"affected":"21.8.3.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cpu-october-2026","oracle","oracle-essbase","other","self-hosted","vendor"],"not_affected_if":[],"how_to_check":"Find your Essbase version. Oracle lists only 21.8.3.0.0 as affected. Then check whether the October 2026 CPU Essbase patch is applied, using the 'Database' patch availability document on My Oracle Support. Any Essbase HTTP endpoint reachable by a low-privilege account is exposed.","fix":"Apply the Essbase patch from Oracle's October 2026 Critical Patch Update (see the Database patch availability document on My Oracle Support). The exact fixed version or patch number is unknown; reading that MOS document would settle it. Until then, limit network access to Essbase HTTP and review low-privilege accounts.","status":"open","published_at":"2026-10-20T22:21:03+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:33:47+00:00","updated_at":"2026-10-24T13:15:55+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T22:33:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown: the affected version is 21.8.3.0.0, but the sources do not name the fixed release.","reach":"network","title":"Oracle Essbase: low-privilege network attacker can take over server","impact":"high","summary":"Oracle Essbase has a security flaw that lets an attacker with a low-privilege account reach it over HTTP from the network. A successful attack takes over the Essbase server and can also affect other products.","category":"other","who_cares":["oracle-essbase"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker takes over Essbase server and affects other products.","analyst_note":"Find the fixed Essbase release for 21.8.3.0.0 and the detection steps in Oracle's advisory; start from https://nvd.nist.gov/vuln/detail/CVE-2026-91637.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.001008,"input_tokens":3076,"output_tokens":1400,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the fixed Essbase release for 21.8.3.0.0 and the detection steps in Oracle's advisory; start from https://nvd.nist.gov/vuln/detail/CVE-2026-91637.","search":"'-2026':13A,16A '-91637':14A,17A '/av':154C '2026':25B,73B '21.8.3.0.0':37B,96C '3.1':141C,153C '9.9':66B,144C 'access':106C 'account':49B 'addit':124C 'affect':94C 'allow':100C 'attack':7A,103C,120C,129C 'avail':148C 'base':142C 'c/c':159C 'chang':127C 'compon':44B,87C 'compromis':110C 'confidenti':145C 'cpu':23B,74B 'cpu-octob':22B 'cve':12A,15A 'cvss':65B,140C,150C,152C 'easili':97C 'essbas':2A,29B,36B,86C,112C,119C,139C 'essbase':19A,21A 'exploit':98C 'fix':68B,81B 'flaw':40B 'h':162C 'h/a':161C 'h/i':160C 'host':33B 'http':54B,108C 'impact':61B,123C,149C 'integr':146C 'l/pr':156C 'l/ui':157C 'low':4A,47B,101C 'low-privileg':3A,46B 'may':121C 'n/ac':155C 'n/s':158C 'name':79B 'network':6A,105C 'octob':24B,72B 'oracl':1A,26B,28B,35B,67B,75B,85C,111C,118C,138C 'oracle':18A,20A 'oracle-essbas':27B 'page':78B 'privileg':5A,48B,102C 'product':64B,125C 'public':77B 'reach':51B 'result':134C 'scope':126C 'score':143C 'secur':43B,88C 'self':32B 'self-host':31B 'server':11A,59B 'signific':122C 'success':128C 'support':90C 'take':9A,56B 'takeov':136C 'vector':151C 'vendor':34B 'version':82B,91C 'via':107C 'vulner':83C,99C,115C,132C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:21:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91637","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91637","severity":null,"published_at":"2026-10-20T22:21:03+00:00","modified_at":"2026-10-23T14:56:37+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91637:327","url":null,"severity":null,"published_at":"2026-10-23T22:55:13+00:00","modified_at":"2026-10-23T22:55:13+00:00","first_seen_at":"2026-10-23T22:55:13+00:00","fetched_at":"2026-10-23T22:55:13+00:00","note":"Oracle CPU Oct 2026 lists CVE-2026-91637 (Essbase, Security, HTTP, CVSS 9.9, PR:L, scope changed, affects 21.8.3.0.0). The advisory gives no fixed version; the patch is in the 'Database' patch availability document on My Oracle Support (support contract needed), which I could not read. No exploitation or PoC found, and no X posts."},{"source":"epss","external_id":"CVE-2026-91637","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91637","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1678,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91637","title":"CVE Record: CVE-2026-91637","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}