{"id":"CVE-2026-91655","kind":"vulnerability","aliases":["CVE-2026-91655"],"related":[],"title":"Oracle Essbase: low-privilege HTTP user can access, change, or disrupt data","description":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).","summary":"Oracle Essbase version 21.8.3.0.0 has a security flaw that a low-privilege user can reach over HTTP. A successful attack reads all Essbase-accessible data, alters or deletes some of it, and can partly disrupt the service.","severity":"critical","cvss":9.1,"epss":0.00208,"exploited":false,"exploited_at":null,"products":[{"name":"oracle essbase","fixed":[],"affected":"= 21.8.3.0.0","ecosystem":"vendor"},{"name":"essbase","fixed":[],"affected":"21.8.3.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["olap","oracle-essbase","other","runtime","self-hosted"],"not_affected_if":["managed-hosting"],"how_to_check":"Check the installed Essbase version; 21.8.3.0.0 is the affected version. Then confirm the Oct 2026 CPU patch is applied (e.g. with OPatch lsinventory), since no fixed version number is published.","fix":"Apply the Oracle October 2026 Critical Patch Update for Essbase via My Oracle Support (Database patch availability document linked from the CPU advisory). Oracle names no fixed version; unknown until the MOS document is read. Until patched, limit HTTP access to Essbase to trusted networks and accounts and review low-privilege accounts.","status":"open","published_at":"2026-10-20T22:21:05+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:33:41+00:00","updated_at":"2026-10-24T13:15:55+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:33:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Essbase: low-privilege HTTP user can access, change, or disrupt data","impact":"high","summary":"Oracle Essbase version 21.8.3.0.0 has a security flaw that a low-privilege user can reach over HTTP. A successful attack reads all Essbase-accessible data, alters or deletes some of it, and can partly disrupt the service.","category":"runtime","who_cares":["oracle-essbase","olap","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads all Essbase data and alters or deletes some","analyst_note":"Find the fixed Essbase version and patch date in Oracle's security alert for CVE-2026-91655; the sources name no fixed version.","how_to_check":"Check the installed Essbase version; the sources list 21.8.3.0.0 as affected.","needs_analyst":true,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000904,"input_tokens":3166,"output_tokens":1175,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the fixed Essbase version and patch date in Oracle's security alert for CVE-2026-91655; the sources name no fixed version.","search":"'-2026':15A,18A '-91655':16A,19A '/av':183C '21.8.3.0.0':35B,84C '3.1':170C,182C '9.1':173C 'abil':156C 'access':9A,57B,94C,125C,131C,136C,146C,152C 'addit':112C 'affect':82C 'allow':88C 'alter':59B 'attack':52B,91C,108C,117C 'avail':177C 'base':171C 'c/c':188C 'caus':158C 'chang':10A,115C 'complet':130C 'compon':75C 'compromis':98C 'confidenti':174C 'critic':127C 'cve':14A,17A 'cvss':169C,179C,181C 'data':13A,58B,128C,137C,153C 'delet':61B,145C 'denial':161C 'disrupt':12A,68B 'dos':165C 'easili':85C 'essbas':2A,26B,33B,56B,74C,100C,107C,135C,151C,168C 'essbase':21A,22A 'essbase-access':55B 'exploit':86C 'flaw':39B 'h/i':189C 'host':31B 'http':6A,49B,96C 'impact':111C,178C 'insert':143C 'integr':175C 'l':191C 'l/a':190C 'l/pr':185C 'l/ui':186C 'low':4A,43B,89C 'low-privileg':3A,42B 'may':109C 'n/ac':184C 'n/s':187C 'network':93C 'olap':23B 'oracl':1A,25B,32B,73C,99C,106C,134C,150C,167C 'oracle':20A 'oracle-essbas':24B 'part':67B 'partial':160C,164C 'privileg':5A,44B,90C 'product':113C 'reach':47B 'read':53B 'result':122C 'runtim':28B 'scope':114C 'score':172C 'secur':38B,76C 'self':30B 'self-host':29B 'servic':70B,163C 'signific':110C 'success':51B,116C 'support':78C 'unauthor':124C,141C,155C 'updat':142C 'user':7A,45B 'vector':180C 'version':34B,79C 'via':95C 'vulner':71C,87C,103C,120C 'well':139C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:21:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91655","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91655","severity":null,"published_at":"2026-10-20T22:21:05+00:00","modified_at":"2026-10-23T14:56:48+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91655:324","url":null,"severity":null,"published_at":"2026-10-23T22:54:05+00:00","modified_at":"2026-10-23T22:54:05+00:00","first_seen_at":"2026-10-23T22:54:05+00:00","fetched_at":"2026-10-23T22:54:05+00:00","note":"Oracle CPU Oct 2026 (published 2026-10-19) lists Essbase 21.8.3.0.0 under the Database patch availability doc; no fixed version number is public, patch is behind My Oracle Support. No PoC or exploitation found; community posts not searched."},{"source":"epss","external_id":"CVE-2026-91655","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91655","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1654,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91655","title":"CVE Record: CVE-2026-91655","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}