---
id: "CVE-2026-91638"
kind: "vulnerability"
aliases: ["CVE-2026-91638"]
title: "Oracle Essbase: low-privilege HTTP request lets attackers take over server"
severity: "critical"
cvss: 9.9
epss: 0.00389
exploited: false
status: "open"
category: "other"
products: [{"name": "oracle essbase", "fixed": [], "affected": "= 21.8.3.0.0", "ecosystem": "vendor"}, {"name": "oracle essbase", "fixed": [], "affected": "21.8.3.0.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["oracle", "oracle-essbase", "other", "self-hosted", "vendor"]
not_affected_if: ["managed-hosting", "unknown"]
published_at: "2026-10-20T22:21:03+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-24T13:15:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91638", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:55:11+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91638", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Oracle Essbase: low-privilege HTTP request lets attackers take over server

Oracle Essbase 21.8.3.0.0 (Security component) has a flaw reachable over HTTP by a low-privileged authenticated user. It can lead to takeover of Essbase and affect other components (scope change). CVSS 3.1 9.9. Oracle fixed it in the October 2026 Critical Patch Update. No public exploitation or PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:oracle essbase affected = 21.8.3.0.0 fixed ?
- vendor:oracle essbase affected 21.8.3.0.0 fixed ?

## How to check

Check your Essbase version: 21.8.3.0.0 is the only affected version Oracle lists. Then see whether the October 2026 CPU Essbase patch is applied (opatch lsinventory, or the patch list in the Essbase install). Anyone with a low-privilege Essbase login over HTTP can reach it.

## Fix

Apply the Essbase patch from Oracle's October 2026 CPU through the 'Database' Patch Availability Document on My Oracle Support (login required). Exact patch or version number: unknown, only readable behind MOS login. Until patched, limit HTTP access to Essbase to trusted networks and remove unneeded low-privilege accounts.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91638
- 2026-10-23T22:55:11+00:00 analyst — Oracle CPU Oct 2026 (cpuoct2026.html) lists Essbase 21.8.3.0.0 affected, CVSS 9.9, PR:L, scope changed; patch is under the 'Database' patch availability doc (MOS, login needed), so no fixed version string was readable. No exploitation or PoC found; social search not done.
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91638

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-91638 https://www.cve.org/CVERecord?id=CVE-2026-91638

## From the sources

Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_