{"id":"CVE-2026-91649","kind":"vulnerability","aliases":["CVE-2026-91649"],"related":[],"title":"Oracle Essbase: Java Based Agent flaw exposes data to high-privilege local users","description":"Vulnerability in Oracle Essbase (component: Java Based Agent).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Essbase executes to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).","summary":"Oracle Essbase's Java Based Agent contains a flaw that lets a user with high privileges and logon access to the host reach Essbase data beyond their rights. The CVSS vector marks it as local, requiring high privileges, with a scope change and high confidentiality impact.","severity":"medium","cvss":6.0,"epss":0.00162,"exploited":false,"exploited_at":null,"products":[{"name":"oracle essbase","fixed":[],"affected":"= 21.8.3.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["java","oracle-essbase","self-hosted","vendor"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"- Check the installed Essbase version against the affected release `21.8.3.0.0`\n- Confirm whether the Java Based Agent component is deployed on the host","fix":"- Apply the Oracle Critical Patch Update fix for Essbase; the fixed version is unknown from the sources\n- Review accounts with logon access to the Essbase host and remove unneeded high-privilege accounts","status":"open","published_at":"2026-10-20T22:21:05+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T04:05:34+00:00","updated_at":"2026-10-25T04:05:34+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:05:34Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Essbase; the fixed version is unknown from the sources\n- Review accounts with logon access to the Essbase host and remove unneeded high-privilege accounts","reach":"local","title":"Oracle Essbase: Java Based Agent flaw exposes data to high-privilege local users","impact":"medium","summary":"Oracle Essbase's Java Based Agent contains a flaw that lets a user with high privileges and logon access to the host reach Essbase data beyond their rights. The CVSS vector marks it as local, requiring high privileges, with a scope change and high confidentiality impact.","category":"vendor","nicknames":[],"who_cares":["oracle-essbase","self-hosted","java"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker reads critical Essbase data and affects other products","analyst_note":"Confirm the fixed version and patch reference from the Oracle Critical Patch Update advisory for Essbase, since the sources give only the affected version.","how_to_check":"- Check the installed Essbase version against the affected release `21.8.3.0.0`\n- Confirm whether the Java Based Agent component is deployed on the host","needs_analyst":true,"not_affected_if":["auth-required","managed-hosting"],"who_is_affected":"Teams running Oracle Essbase 21.8.3.0.0 where the Java Based Agent is present on a host that users can log into. The attacker must already hold high privileges and local logon, so exposure is limited to internal access paths. Teams not running Essbase, or running a different version, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00065,"input_tokens":3543,"output_tokens":592,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-91649':17A,20A '/av':161C '21.8.3.0.0':92C '3.1':151C,160C '6.0':154C 'access':49B,137C,143C,148C 'addit':124C 'affect':90C 'agent':5A,36B,84C 'allow':96C 'attack':99C,120C,129C 'base':4A,35B,83C,152C 'beyond':56B 'c/c':166C 'chang':72B,127C 'complet':142C 'compon':81C 'compromis':110C 'confidenti':75B,155C 'contain':37B 'critic':139C 'cve':15A,18A 'cvss':60B,150C,157C,159C 'data':8A,55B,140C,149C 'easili':93C 'essbas':2A,26B,32B,54B,80C,107C,112C,119C,147C 'essbase':22A 'execut':108C 'exploit':94C 'expos':7A 'flaw':6A,39B 'h/i':167C 'h/ui':164C 'high':11A,45B,67B,74B,97C 'high-privileg':10A 'host':29B,52B 'impact':76B,123C,156C 'infrastructur':104C 'java':3A,23B,34B,82C 'l/ac':162C 'l/pr':163C 'let':41B 'local':13A,65B 'logon':48B,101C 'mark':62B 'may':121C 'n':169C 'n/a':168C 'n/s':165C 'oracl':1A,25B,31B,79C,106C,111C,118C,146C 'oracle':21A 'oracle-essbas':24B 'privileg':12A,46B,68B,98C 'product':125C 'reach':53B 'requir':66B 'result':134C 'right':58B 'scope':71B,126C 'score':153C 'self':28B 'self-host':27B 'signific':122C 'success':128C 'support':86C 'unauthor':136C 'user':14A,43B 'vector':61B,158C 'vendor':30B 'version':87C 'vulner':77C,95C,115C,132C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle Essbase 21.8.3.0.0 where the Java Based Agent is present on a host that users can log into. The attacker must already hold high privileges and local logon, so exposure is limited to internal access paths. Teams not running Essbase, or running a different version, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:21:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91649","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91649","severity":null,"published_at":"2026-10-20T22:21:05+00:00","modified_at":"2026-10-23T14:59:17+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91649","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91649","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}