{"id":"CVE-2026-91658","kind":"vulnerability","aliases":["CVE-2026-91658"],"related":[],"title":"Oracle Essbase: low-privileged HTTP user can take over the server","description":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","summary":"Oracle Essbase 21.8.3.0.0 has a flaw in the Security component. A low-privileged user with HTTP access can take over Essbase, and the impact can reach other products in the environment (scope change, CVSS 9.9). Oracle fixed it in the October 2026 Critical Patch Update, which carries 38 Essbase fixes. No exploitation or public PoC is known.","severity":"critical","cvss":9.9,"epss":0.00286,"exploited":false,"exploited_at":null,"products":[{"name":"oracle essbase","fixed":[],"affected":"= 21.8.3.0.0","ecosystem":"vendor"},{"name":"essbase","fixed":[],"affected":"= 21.8.3.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["enterprise-analytics","oracle-essbase","self-hosted","vendor"],"not_affected_if":["managed-hosting","no-http-exposure","other-versions"],"how_to_check":"Check your Essbase release: 21.8.3.0.0 is the affected version. Then confirm the October 2026 CPU Essbase patch is installed (see the patch availability document on My Oracle Support). Check whether Essbase HTTP is reachable by untrusted users, since any low-privileged account is enough.","fix":"Apply the Oracle October 2026 CPU patch for Essbase from My Oracle Support (linked from cpuoct2026). Oracle's public pages give no new version string. Until patched, restrict Essbase HTTP access to trusted networks and review low-privileged accounts. Patch together with the other Essbase CPU fixes.","status":"open","published_at":"2026-10-20T22:21:06+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:33:36+00:00","updated_at":"2026-10-24T13:15:55+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T22:33:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Essbase: low-privileged HTTP user can take over the server","impact":"high","summary":"Oracle Essbase 21.8.3.0.0 has a Security component flaw that a low-privileged user can trigger over HTTP. A successful attack gives full takeover of Essbase and can reach other products in the environment.","category":"vendor","who_cares":["oracle-essbase","enterprise-analytics","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker takes over Essbase and reaches other connected products","analyst_note":"Find Oracle's Critical Patch Update advisory for CVE-2026-91658 to confirm fixed version and patch link; the sources only name 21.8.3.0.0 as affected.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-versions","no-http-exposure"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000489,"input_tokens":3085,"output_tokens":360,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for CVE-2026-91658 to confirm fixed version and patch link; the sources only name 21.8.3.0.0 as affected.","search":"'-2026':14A,17A '-91658':15A,18A '/av':161C '2026':74B '21.8.3.0.0':34B,103C '3.1':148C,160C '38':80B '9.9':67B,151C 'access':49B,113C 'addit':131C 'affect':101C 'allow':107C 'analyt':24B 'attack':110C,127C,136C 'avail':155C 'base':149C 'c/c':166C 'carri':79B 'chang':65B,134C 'compon':41B,94C 'compromis':117C 'confidenti':152C 'critic':75B 'cve':13A,16A 'cvss':66B,147C,157C,159C 'easili':104C 'enterpris':23B 'enterprise-analyt':22B 'environ':63B 'essbas':2A,27B,33B,53B,81B,93C,119C,126C,146C 'essbase':20A,21A 'exploit':84B,105C 'fix':69B,82B 'flaw':37B 'h':169C 'h/a':168C 'h/i':167C 'host':30B 'http':6A,48B,115C 'impact':56B,130C,156C 'integr':153C 'known':89B 'l/pr':163C 'l/ui':164C 'low':4A,44B,108C 'low-privileg':3A,43B 'may':128C 'n/ac':162C 'n/s':165C 'network':112C 'octob':73B 'oracl':1A,26B,32B,68B,92C,118C,125C,145C 'oracle':19A 'oracle-essbas':25B 'patch':76B 'poc':87B 'privileg':5A,45B,109C 'product':60B,132C 'public':86B 'reach':58B 'result':141C 'scope':64B,133C 'score':150C 'secur':40B,95C 'self':29B 'self-host':28B 'server':12A 'signific':129C 'success':135C 'support':97C 'take':9A,51B 'takeov':143C 'updat':77B 'user':7A,46B 'vector':158C 'vendor':31B 'version':98C 'via':114C 'vulner':90C,106C,122C,139C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:21:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91658","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91658","severity":null,"published_at":"2026-10-20T22:21:06+00:00","modified_at":"2026-10-23T17:19:01+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91658:322","url":null,"severity":null,"published_at":"2026-10-23T22:54:03+00:00","modified_at":"2026-10-23T22:54:03+00:00","first_seen_at":"2026-10-23T22:54:03+00:00","fetched_at":"2026-10-23T22:54:03+00:00","note":"Oracle Oct 2026 CPU (cpuoct2026) lists Essbase 21.8.3.0.0 affected, CVSS 9.9 (AV:N/PR:L/S:C), fixed via CPU patch; no fixed version string or patch number in pages read (MOS patch availability doc not opened). No exploitation or PoC found; X/Bluesky not searched."},{"source":"epss","external_id":"CVE-2026-91658","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91658","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1639,"url":"https://www.oracle.com/security-alerts/cpuoct2026verbose.html","title":"Text Form of Oracle CPU October 2026 Risk Matrices","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1652,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91658","title":"CVE Record: CVE-2026-91658","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}