{"id":"CVE-2026-91638","kind":"vulnerability","aliases":["CVE-2026-91638"],"related":[],"title":"Oracle Essbase: low-privilege HTTP request lets attackers take over server","description":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","summary":"Oracle Essbase 21.8.3.0.0 (Security component) has a flaw reachable over HTTP by a low-privileged authenticated user. It can lead to takeover of Essbase and affect other components (scope change). CVSS 3.1 9.9. Oracle fixed it in the October 2026 Critical Patch Update. No public exploitation or PoC found.","severity":"critical","cvss":9.9,"epss":0.00389,"exploited":false,"exploited_at":null,"products":[{"name":"oracle essbase","fixed":[],"affected":"= 21.8.3.0.0","ecosystem":"vendor"},{"name":"oracle essbase","fixed":[],"affected":"21.8.3.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["oracle","oracle-essbase","other","self-hosted","vendor"],"not_affected_if":["managed-hosting","unknown"],"how_to_check":"Check your Essbase version: 21.8.3.0.0 is the only affected version Oracle lists. Then see whether the October 2026 CPU Essbase patch is applied (opatch lsinventory, or the patch list in the Essbase install). Anyone with a low-privilege Essbase login over HTTP can reach it.","fix":"Apply the Essbase patch from Oracle's October 2026 CPU through the 'Database' Patch Availability Document on My Oracle Support (login required). Exact patch or version number: unknown, only readable behind MOS login. Until patched, limit HTTP access to Essbase to trusted networks and remove unneeded low-privilege accounts.","status":"open","published_at":"2026-10-20T22:21:03+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:33:40+00:00","updated_at":"2026-10-24T13:15:55+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T22:33:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Essbase: low-privilege HTTP request lets attackers take over server","impact":"high","summary":"Oracle Essbase has a security flaw that lets a low-privilege user with network access over HTTP take over the server. The sources say an attacker can also affect other products, and they report a CVSS score of 9.9.","category":"other","who_cares":["oracle-essbase","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker takes over Essbase server and affects other products","analyst_note":"Find Oracle's Critical Patch Update advisory for CVE-2026-91638 for patched version and exposure steps; the NVD entry lists only affected version 21.8.3.0.0.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000476,"input_tokens":3076,"output_tokens":337,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for CVE-2026-91638 for patched version and exposure steps; the NVD entry lists only affected version 21.8.3.0.0.","search":"'-2026':14A,17A '-91638':15A,18A '/av':153C '2026':72B '21.8.3.0.0':34B,95C '3.1':64B,140C,152C '9.9':65B,143C 'access':105C 'addit':123C 'affect':58B,93C 'allow':99C 'attack':9A,102C,119C,128C 'authent':48B 'avail':147C 'base':141C 'c/c':158C 'chang':62B,126C 'compon':36B,60B,86C 'compromis':109C 'confidenti':144C 'critic':73B 'cve':13A,16A 'cvss':63B,139C,149C,151C 'easili':96C 'essbas':2A,26B,33B,56B,85C,111C,118C,138C 'essbase':20A,22A 'exploit':78B,97C 'fix':67B 'flaw':39B 'found':81B 'h':161C 'h/a':160C 'h/i':159C 'host':30B 'http':6A,42B,107C 'impact':122C,148C 'integr':145C 'l/pr':155C 'l/ui':156C 'lead':52B 'let':8A 'low':4A,46B,100C 'low-privileg':3A,45B 'may':120C 'n/ac':154C 'n/s':157C 'network':104C 'octob':71B 'oracl':1A,23B,25B,32B,66B,84C,110C,117C,137C 'oracle':19A,21A 'oracle-essbas':24B 'patch':74B 'poc':80B 'privileg':5A,47B,101C 'product':124C 'public':77B 'reachabl':40B 'request':7A 'result':133C 'scope':61B,125C 'score':142C 'secur':35B,87C 'self':29B 'self-host':28B 'server':12A 'signific':121C 'success':127C 'support':89C 'take':10A 'takeov':54B,135C 'updat':75B 'user':49B 'vector':150C 'vendor':31B 'version':90C 'via':106C 'vulner':82C,98C,114C,131C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:21:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91638","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91638","severity":null,"published_at":"2026-10-20T22:21:03+00:00","modified_at":"2026-10-23T17:19:18+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91638:326","url":null,"severity":null,"published_at":"2026-10-23T22:55:11+00:00","modified_at":"2026-10-23T22:55:11+00:00","first_seen_at":"2026-10-23T22:55:11+00:00","fetched_at":"2026-10-23T22:55:11+00:00","note":"Oracle CPU Oct 2026 (cpuoct2026.html) lists Essbase 21.8.3.0.0 affected, CVSS 9.9, PR:L, scope changed; patch is under the 'Database' patch availability doc (MOS, login needed), so no fixed version string was readable. No exploitation or PoC found; social search not done."},{"source":"epss","external_id":"CVE-2026-91638","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91638","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1677,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91638","title":"CVE Record: CVE-2026-91638","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}