{"id":"CVE-2026-91656","kind":"vulnerability","aliases":["CVE-2026-91656"],"related":[],"title":"Oracle Essbase: low-privilege network user can read and alter data","description":"Vulnerability in Oracle Essbase (component: Federated Partitions).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).","summary":"Oracle Essbase's Federated Partitions component has a flaw that lets a low-privileged user reach it over HTTP. A successful attack reads all Essbase-accessible data, changes or deletes some of it, and can partly crash the service, with a scope change that can affect other products.","severity":"critical","cvss":9.1,"epss":0.00208,"exploited":false,"exploited_at":null,"products":[{"name":"oracle essbase","fixed":[],"affected":"= 21.8.3.0.0","ecosystem":"vendor"},{"name":"essbase","fixed":[],"affected":"21.8.3.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["federated-partitions","oracle-essbase","other","self-hosted","vendor","version-21.8.3.0.0"],"not_affected_if":["managed-hosting"],"how_to_check":"Check your Essbase version (21.8.3.0.0 is affected) and whether the Oct 2026 CPU patch for Essbase is installed (see the Database patch availability document in MOS). Essbase HTTP endpoints reachable by low-privileged users are the exposure.","fix":"Apply the Oracle October 2026 Critical Patch Update for Essbase 21.8.3.0.0 from My Oracle Support. The fixed version number is not published in public sources (unknown; the MOS patch document would settle it). Until patched, restrict network access to the Essbase HTTP interface to trusted ranges and review low-privilege accounts.","status":"open","published_at":"2026-10-20T22:21:05+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:33:40+00:00","updated_at":"2026-10-24T13:15:55+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:33:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown: the sources do not name a fixed release.","reach":"network","title":"Oracle Essbase: low-privilege network user can read and alter data","impact":"high","summary":"Oracle Essbase's Federated Partitions component has a flaw that lets a low-privileged user reach it over HTTP. A successful attack reads all Essbase-accessible data, changes or deletes some of it, and can partly crash the service, with a scope change that can affect other products.","category":"other","who_cares":["oracle-essbase","version-21.8.3.0.0"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads all Essbase data and alters or deletes some","analyst_note":"Find the fixed Essbase release for 21.8.3.0.0 in Oracle's advisory for CVE-2026-91656, starting from https://nvd.nist.gov/vuln/detail/CVE-2026-91656.","how_to_check":"Check the installed Essbase version; the affected release is 21.8.3.0.0.","needs_analyst":true,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000966,"input_tokens":3169,"output_tokens":1299,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the fixed Essbase release for 21.8.3.0.0 in Oracle's advisory for CVE-2026-91656, starting from https://nvd.nist.gov/vuln/detail/CVE-2026-91656.","search":"'-2026':14A,17A '-91656':15A,18A '/av':198C '21.8.3.0.0':34B,99C '3.1':185C,197C '9.1':188C 'abil':171C 'access':62B,109C,140C,146C,151C,161C,167C 'addit':127C 'affect':82B,97C 'allow':103C 'alter':11A 'attack':57B,106C,123C,132C 'avail':192C 'base':186C 'c/c':203C 'caus':173C 'chang':64B,79B,130C 'complet':145C 'compon':40B,89C 'compromis':113C 'confidenti':189C 'crash':73B 'critic':142C 'cve':13A,16A 'cvss':184C,194C,196C 'data':12A,63B,143C,152C,168C 'delet':66B,160C 'denial':176C 'dos':180C 'easili':100C 'essbas':2A,27B,36B,61B,88C,115C,122C,150C,166C,183C 'essbase':20A,21A 'essbase-access':60B 'exploit':101C 'feder':23B,38B,90C 'federated-partit':22B 'flaw':43B 'h/i':204C 'host':31B 'http':54B,111C 'impact':126C,193C 'insert':158C 'integr':190C 'l':206C 'l/a':205C 'l/pr':200C 'l/ui':201C 'let':45B 'low':4A,48B,104C 'low-privileg':3A,47B 'may':124C 'n/ac':199C 'n/s':202C 'network':6A,108C 'oracl':1A,26B,35B,87C,114C,121C,149C,165C,182C 'oracle':19A 'oracle-essbas':25B 'part':72B 'partial':175C,179C 'partit':24B,39B,91C 'privileg':5A,49B,105C 'product':84B,128C 'reach':51B 'read':9A,58B 'result':137C 'scope':78B,129C 'score':187C 'self':30B 'self-host':29B 'servic':75B,178C 'signific':125C 'success':56B,131C 'support':93C 'unauthor':139C,156C,170C 'updat':157C 'user':7A,50B 'vector':195C 'vendor':32B 'version':33B,94C 'via':110C 'vulner':85C,102C,118C,135C 'well':154C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:21:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91656","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91656","severity":null,"published_at":"2026-10-20T22:21:05+00:00","modified_at":"2026-10-23T14:35:07+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91656:323","url":null,"severity":null,"published_at":"2026-10-23T22:54:08+00:00","modified_at":"2026-10-23T22:54:08+00:00","first_seen_at":"2026-10-23T22:54:08+00:00","fetched_at":"2026-10-23T22:54:08+00:00","note":"Oracle CPU Oct 2026 (cpuoct2026 + verbose risk matrix) confirms affected 21.8.3.0.0 only, CVSS 9.1 (PR:L, S:C). Oracle does not name a fixed Essbase release publicly: fix is the Oct 2026 CPU patch via My Oracle Support (Database patch doc, login needed). No exploitation or PoC found; no notable public discussion searched on X."},{"source":"epss","external_id":"CVE-2026-91656","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91656","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1639,"url":"https://www.oracle.com/security-alerts/cpuoct2026verbose.html","title":"Text Form of Oracle CPU October 2026 Risk Matrices","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}