---
id: "CVE-2026-91649"
kind: "vulnerability"
aliases: ["CVE-2026-91649"]
title: "Oracle Essbase: Java Based Agent flaw exposes data to high-privilege local users"
severity: "medium"
cvss: 6.0
epss: 0.00162
exploited: false
status: "open"
category: "vendor"
products: [{"name": "oracle essbase", "fixed": [], "affected": "= 21.8.3.0.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["java", "oracle-essbase", "self-hosted", "vendor"]
not_affected_if: ["auth-required", "managed-hosting"]
published_at: "2026-10-20T22:21:05+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T04:05:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91649", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91649", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Oracle Essbase: Java Based Agent flaw exposes data to high-privilege local users

Oracle Essbase's Java Based Agent contains a flaw that lets a user with high privileges and logon access to the host reach Essbase data beyond their rights. The CVSS vector marks it as local, requiring high privileges, with a scope change and high confidentiality impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:oracle essbase affected = 21.8.3.0.0 fixed ?

## How to check

- Check the installed Essbase version against the affected release `21.8.3.0.0`
- Confirm whether the Java Based Agent component is deployed on the host

## Fix

- Apply the Oracle Critical Patch Update fix for Essbase; the fixed version is unknown from the sources
- Review accounts with logon access to the Essbase host and remove unneeded high-privilege accounts

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91649
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91649

## From the sources

Vulnerability in Oracle Essbase (component: Java Based Agent).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Essbase executes to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_