---
id: "CVE-2026-91640"
kind: "vulnerability"
aliases: ["CVE-2026-91640"]
title: "Oracle Essbase: low-privilege network attacker reads a subset of data"
severity: "medium"
cvss: 5.0
epss: 0.00224
exploited: false
status: "open"
category: "other"
products: [{"name": "oracle essbase", "fixed": [], "affected": "= 21.8.3.0.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["enterprise", "oracle-essbase", "other", "self-hosted"]
not_affected_if: ["no-low-privilege-users", "other-essbase-versions"]
published_at: "2026-10-20T22:21:04+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T04:30:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91640", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91640", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Oracle Essbase: low-privilege network attacker reads a subset of data

Oracle Essbase has a flaw in its Security component that lets a low-privileged user reach data over HTTP. The attacker gets unauthorized read access to a subset of the data Essbase holds, and CVSS notes the scope change could affect other products.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:oracle essbase affected = 21.8.3.0.0 fixed ?

## How to check

- Check the installed Essbase version against the affected release `21.8.3.0.0`
- Confirm the Oracle Essbase patch level in your Oracle inventory or deployment records

## Fix

- Apply the Oracle Critical Patch Update that addresses this CVE to Essbase (fixed version: unknown)

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91640
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91640

## From the sources

Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.0 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_