{"id":"CVE-2026-91661","kind":"vulnerability","aliases":["CVE-2026-91661"],"related":[],"title":"Oracle Essbase: low-privilege HTTP attacker can read critical data","description":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","summary":"Oracle Essbase has a Security component flaw reachable over HTTP by a low-privileged user. Successful exploitation gives unauthorized access to critical data and, because of scope change, can reach other products.","severity":"high","cvss":7.7,"epss":0.003,"exploited":false,"exploited_at":null,"products":[{"name":"oracle essbase","fixed":[],"affected":"= 21.8.3.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["analytics","essbase","on-prem","oracle","vendor"],"not_affected_if":["essbase-not-installed","network-restricted"],"how_to_check":"- Confirm the installed Essbase release with the Oracle admin tooling; the affected version listed is `21.8.3.0.0`\n- Check Oracle's Critical Patch Update advisory for the Essbase patch that matches your release: unknown","fix":"- Apply the Oracle Critical Patch Update fix for Essbase; the fixed version is unknown from the sources\n- Restrict HTTP access to Essbase to trusted networks until patched","status":"open","published_at":"2026-10-20T22:21:06+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:10:33+00:00","updated_at":"2026-10-25T03:10:33+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:10:33Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Essbase; the fixed version is unknown from the sources\n- Restrict HTTP access to Essbase to trusted networks until patched","reach":"internet","title":"Oracle Essbase: low-privilege HTTP attacker can read critical data","impact":"high","summary":"Oracle Essbase has a Security component flaw reachable over HTTP by a low-privileged user. Successful exploitation gives unauthorized access to critical data and, because of scope change, can reach other products.","category":"vendor","nicknames":[],"who_cares":["oracle","essbase","on-prem","analytics"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads critical and all Essbase-accessible data","analyst_note":"Check the Oracle CPU advisory for the fixed Essbase version and the HTTP endpoint details: https://nvd.nist.gov/vuln/detail/CVE-2026-91661","how_to_check":"- Confirm the installed Essbase release with the Oracle admin tooling; the affected version listed is `21.8.3.0.0`\n- Check Oracle's Critical Patch Update advisory for the Essbase patch that matches your release: unknown","needs_analyst":true,"not_affected_if":["essbase-not-installed","network-restricted"],"who_is_affected":"Organizations running Oracle Essbase `21.8.3.0.0` that expose its HTTP interface to users with any account. Installations where Essbase is reachable only from a tightly controlled internal network carry less exposure. Teams not running Essbase can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00065,"input_tokens":3519,"output_tokens":596,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-91661':14A,17A '/av':138C '21.8.3.0.0':73C '3.1':128C,137C '7.7':131C 'access':47B,83C,114C,120C,125C 'addit':101C 'affect':71C 'allow':77C 'analyt':20B 'attack':7A,80C,97C,106C 'base':129C 'c/c':143C 'chang':55B,104C 'complet':119C 'compon':32B,64C 'compromis':87C 'confidenti':132C 'critic':10A,49B,116C 'cve':12A,15A 'cvss':127C,134C,136C 'data':11A,50B,117C,126C 'easili':74C 'essbas':2A,21B,28B,63C,89C,96C,124C 'essbase':19A 'exploit':44B,75C 'flaw':33B 'give':45B 'h/i':144C 'http':6A,36B,85C 'impact':100C,133C 'l/pr':140C 'l/ui':141C 'low':4A,40B,78C 'low-privileg':3A,39B 'may':98C 'n':146C 'n/a':145C 'n/ac':139C 'n/s':142C 'network':82C 'on-prem':22B 'oracl':1A,25B,27B,62C,88C,95C,123C 'oracle':18A 'prem':24B 'privileg':5A,41B,79C 'product':59B,102C 'reach':57B 'reachabl':34B 'read':9A 'result':111C 'scope':54B,103C 'score':130C 'secur':31B,65C 'signific':99C 'success':43B,105C 'support':67C 'unauthor':46B,113C 'user':42B 'vector':135C 'vendor':26B 'version':68C 'via':84C 'vulner':60C,76C,92C,109C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle Essbase `21.8.3.0.0` that expose its HTTP interface to users with any account. Installations where Essbase is reachable only from a tightly controlled internal network carry less exposure. Teams not running Essbase can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:21:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91661","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91661","severity":null,"published_at":"2026-10-20T22:21:06+00:00","modified_at":"2026-10-23T17:18:44+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91661","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91661","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}