{"id":"CVE-2026-91660","kind":"vulnerability","aliases":["CVE-2026-91660"],"related":[],"title":"Oracle Essbase: low-privilege HTTP request can partly deny service","description":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 4.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).","summary":"A low-privileged user with network access over HTTP can trigger a partial denial of service in Oracle Essbase, per the CVSS 3.1 vector. The sources describe only an availability impact, with no code execution or data exposure.","severity":"medium","cvss":4.3,"epss":0.00291,"exploited":false,"exploited_at":null,"products":[{"name":"oracle essbase","fixed":[],"affected":"= 21.8.3.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["oracle-essbase","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Essbase version against the affected release `21.8.3.0.0`\n- Confirm the Oracle Essbase Security component advisory listing for the patched build","fix":"- unknown","status":"open","published_at":"2026-10-20T22:21:06+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T04:37:44+00:00","updated_at":"2026-10-25T04:37:44+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T04:37:44Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Oracle Essbase: low-privilege HTTP request can partly deny service","impact":"low","summary":"A low-privileged user with network access over HTTP can trigger a partial denial of service in Oracle Essbase, per the CVSS 3.1 vector. The sources describe only an availability impact, with no code execution or data exposure.","category":"vendor","nicknames":[],"who_cares":["oracle-essbase","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Partial denial of service of the Essbase server","analyst_note":"Find the Oracle Critical Patch Update advisory for CVE-2026-91660 to confirm the fixed build and any workaround; the NVD entry gives no fix version.","how_to_check":"- Check the installed Essbase version against the affected release `21.8.3.0.0`\n- Confirm the Oracle Essbase Security component advisory listing for the patched build","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Deployments of Oracle Essbase version 21.8.3.0.0 that accept HTTP traffic from users with low-privilege accounts are the ones the sources describe. Teams that do not run Essbase, or run a different version, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000591,"input_tokens":3485,"output_tokens":485,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-91660':14A,17A '/av':129C '21.8.3.0.0':79C '3.1':50B,119C,128C '4.3':122C 'abil':105C 'access':34B,89C 'affect':77C 'allow':83C 'attack':86C,97C 'avail':57B,123C 'base':120C 'caus':107C 'code':61B 'compon':70C 'compromis':93C 'cve':12A,15A 'cvss':49B,118C,125C,127C 'data':64B 'deni':10A 'denial':41B,110C 'describ':54B 'dos':114C 'easili':80C 'essbas':2A,22B,46B,69C,95C,117C 'essbase':19A 'execut':62B 'exploit':81C 'exposur':65B 'host':25B 'http':6A,36B,91C 'impact':58B,124C 'l':137C 'l/pr':131C 'l/ui':132C 'low':4A,29B,84C 'low-privileg':3A,28B 'n/a':136C 'n/ac':130C 'n/i':135C 'n/s':133C 'network':33B,88C 'oracl':1A,21B,45B,68C,94C,116C 'oracle':18A 'oracle-essbas':20B 'part':9A 'partial':40B,109C,113C 'per':47B 'privileg':5A,30B,85C 'request':7A 'result':102C 'score':121C 'secur':71C 'self':24B 'self-host':23B 'servic':11A,43B,112C 'sourc':53B 'success':96C 'support':73C 'trigger':38B 'u/c':134C 'unauthor':104C 'user':31B 'vector':51B,126C 'vendor':26B 'version':74C 'via':90C 'vulner':66C,82C,100C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Oracle Essbase version 21.8.3.0.0 that accept HTTP traffic from users with low-privilege accounts are the ones the sources describe. Teams that do not run Essbase, or run a different version, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:21:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91660","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91660","severity":null,"published_at":"2026-10-20T22:21:06+00:00","modified_at":"2026-10-23T17:18:48+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91660","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91660","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}