---
id: "CVE-2026-91656"
kind: "vulnerability"
aliases: ["CVE-2026-91656"]
title: "Oracle Essbase: low-privilege network user can read and alter data"
severity: "critical"
cvss: 9.1
epss: 0.00208
exploited: false
status: "open"
category: "other"
products: [{"name": "oracle essbase", "fixed": [], "affected": "= 21.8.3.0.0", "ecosystem": "vendor"}, {"name": "essbase", "fixed": [], "affected": "21.8.3.0.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["federated-partitions", "oracle-essbase", "other", "self-hosted", "vendor", "version-21.8.3.0.0"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-20T22:21:05+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-24T13:15:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91656", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:54:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91656", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Oracle Essbase: low-privilege network user can read and alter data

Oracle Essbase's Federated Partitions component has a flaw that lets a low-privileged user reach it over HTTP. A successful attack reads all Essbase-accessible data, changes or deletes some of it, and can partly crash the service, with a scope change that can affect other products.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:oracle essbase affected = 21.8.3.0.0 fixed ?
- vendor:essbase affected 21.8.3.0.0 fixed ?

## How to check

Check your Essbase version (21.8.3.0.0 is affected) and whether the Oct 2026 CPU patch for Essbase is installed (see the Database patch availability document in MOS). Essbase HTTP endpoints reachable by low-privileged users are the exposure.

## Fix

Apply the Oracle October 2026 Critical Patch Update for Essbase 21.8.3.0.0 from My Oracle Support. The fixed version number is not published in public sources (unknown; the MOS patch document would settle it). Until patched, restrict network access to the Essbase HTTP interface to trusted ranges and review low-privilege accounts.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91656
- 2026-10-23T22:54:08+00:00 analyst — Oracle CPU Oct 2026 (cpuoct2026 + verbose risk matrix) confirms affected 21.8.3.0.0 only, CVSS 9.1 (PR:L, S:C). Oracle does not name a fixed Essbase release publicly: fix is the Oct 2026 CPU patch via My Oracle Support (Database patch doc, login needed). No exploitation or PoC found; no notable public discussion searched on X.
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91656

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [advisory] Text Form of Oracle CPU October 2026 Risk Matrices https://www.oracle.com/security-alerts/cpuoct2026verbose.html

## From the sources

Vulnerability in Oracle Essbase (component: Federated Partitions).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_