---
id: "CVE-2026-91655"
kind: "vulnerability"
aliases: ["CVE-2026-91655"]
title: "Oracle Essbase: low-privilege HTTP user can access, change, or disrupt data"
severity: "critical"
cvss: 9.1
epss: 0.00208
exploited: false
status: "open"
category: "runtime"
products: [{"name": "oracle essbase", "fixed": [], "affected": "= 21.8.3.0.0", "ecosystem": "vendor"}, {"name": "essbase", "fixed": [], "affected": "21.8.3.0.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["olap", "oracle-essbase", "other", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-20T22:21:05+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-24T13:15:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91655", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:54:05+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91655", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Oracle Essbase: low-privilege HTTP user can access, change, or disrupt data

Oracle Essbase version 21.8.3.0.0 has a security flaw that a low-privilege user can reach over HTTP. A successful attack reads all Essbase-accessible data, alters or deletes some of it, and can partly disrupt the service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:oracle essbase affected = 21.8.3.0.0 fixed ?
- vendor:essbase affected 21.8.3.0.0 fixed ?

## How to check

Check the installed Essbase version; 21.8.3.0.0 is the affected version. Then confirm the Oct 2026 CPU patch is applied (e.g. with OPatch lsinventory), since no fixed version number is published.

## Fix

Apply the Oracle October 2026 Critical Patch Update for Essbase via My Oracle Support (Database patch availability document linked from the CPU advisory). Oracle names no fixed version; unknown until the MOS document is read. Until patched, limit HTTP access to Essbase to trusted networks and accounts and review low-privilege accounts.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91655
- 2026-10-23T22:54:05+00:00 analyst — Oracle CPU Oct 2026 (published 2026-10-19) lists Essbase 21.8.3.0.0 under the Database patch availability doc; no fixed version number is public, patch is behind My Oracle Support. No PoC or exploitation found; community posts not searched.
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91655

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-91655 https://www.cve.org/CVERecord?id=CVE-2026-91655

## From the sources

Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_