{"id":"CVE-2026-91640","kind":"vulnerability","aliases":["CVE-2026-91640"],"related":[],"title":"Oracle Essbase: low-privilege network attacker reads a subset of data","description":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.0 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).","summary":"Oracle Essbase has a flaw in its Security component that lets a low-privileged user reach data over HTTP. The attacker gets unauthorized read access to a subset of the data Essbase holds, and CVSS notes the scope change could affect other products.","severity":"medium","cvss":5.0,"epss":0.00224,"exploited":false,"exploited_at":null,"products":[{"name":"oracle essbase","fixed":[],"affected":"= 21.8.3.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["enterprise","oracle-essbase","other","self-hosted"],"not_affected_if":["no-low-privilege-users","other-essbase-versions"],"how_to_check":"- Check the installed Essbase version against the affected release `21.8.3.0.0`\n- Confirm the Oracle Essbase patch level in your Oracle inventory or deployment records","fix":"- Apply the Oracle Critical Patch Update that addresses this CVE to Essbase (fixed version: unknown)","status":"open","published_at":"2026-10-20T22:21:04+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T04:30:39+00:00","updated_at":"2026-10-25T04:30:39+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:30:39Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update that addresses this CVE to Essbase (fixed version: unknown)","reach":"network","title":"Oracle Essbase: low-privilege network attacker reads a subset of data","impact":"low","summary":"Oracle Essbase has a flaw in its Security component that lets a low-privileged user reach data over HTTP. The attacker gets unauthorized read access to a subset of the data Essbase holds, and CVSS notes the scope change could affect other products.","category":"other","nicknames":[],"who_cares":["oracle-essbase","self-hosted","enterprise"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads a subset of Essbase data and may affect other products","analyst_note":"Find the fixed Essbase version and patch reference in the Oracle Critical Patch Update advisory for CVE-2026-91640; the sources here do not name it.","how_to_check":"- Check the installed Essbase version against the affected release `21.8.3.0.0`\n- Confirm the Oracle Essbase patch level in your Oracle inventory or deployment records","needs_analyst":true,"not_affected_if":["other-essbase-versions","no-low-privilege-users"],"who_is_affected":"Teams running Oracle Essbase version `21.8.3.0.0` that accept HTTP access from users with low-privilege accounts are exposed. Installations that do not run this version, or that restrict access to trusted administrators, have less exposure. Whether the sources list an exact fixed build is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000638,"input_tokens":3516,"output_tokens":572,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-91640':15A,18A '/av':148C '21.8.3.0.0':86C '3.1':138C,147C '5.0':141C 'access':54B,96C,128C,135C 'addit':114C 'affect':70B,84C 'allow':90C 'attack':7A,50B,93C,110C,119C 'base':139C 'c/c':153C 'chang':68B,117C 'compon':37B,77C 'compromis':100C 'confidenti':142C 'could':69B 'cve':13A,16A 'cvss':64B,137C,144C,146C 'data':12A,46B,60B,136C 'easili':87C 'enterpris':21B 'essbas':2A,24B,30B,61B,76C,102C,109C,134C 'essbase':20A 'exploit':88C 'flaw':33B 'get':51B 'hold':62B 'host':28B 'http':48B,98C 'impact':113C,143C 'l/i':154C 'l/pr':150C 'l/ui':151C 'let':39B 'low':4A,42B,91C 'low-privileg':3A,41B 'may':111C 'n':156C 'n/a':155C 'n/ac':149C 'n/s':152C 'network':6A,95C 'note':65B 'oracl':1A,23B,29B,75C,101C,108C,133C 'oracle':19A 'oracle-essbas':22B 'privileg':5A,43B,92C 'product':72B,115C 'reach':45B 'read':8A,53B,127C 'result':124C 'scope':67B,116C 'score':140C 'secur':36B,78C 'self':27B 'self-host':26B 'signific':112C 'subset':10A,57B,131C 'success':118C 'support':80C 'unauthor':52B,126C 'user':44B 'vector':145C 'version':81C 'via':97C 'vulner':73C,89C,105C,122C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle Essbase version `21.8.3.0.0` that accept HTTP access from users with low-privilege accounts are exposed. Installations that do not run this version, or that restrict access to trusted administrators, have less exposure. Whether the sources list an exact fixed build is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:21:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91640","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91640","severity":null,"published_at":"2026-10-20T22:21:04+00:00","modified_at":"2026-10-23T14:57:39+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91640","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91640","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}