---
id: "CVE-2026-91661"
kind: "vulnerability"
aliases: ["CVE-2026-91661"]
title: "Oracle Essbase: low-privilege HTTP attacker can read critical data"
severity: "high"
cvss: 7.7
epss: 0.003
exploited: false
status: "open"
category: "vendor"
products: [{"name": "oracle essbase", "fixed": [], "affected": "= 21.8.3.0.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["analytics", "essbase", "on-prem", "oracle", "vendor"]
not_affected_if: ["essbase-not-installed", "network-restricted"]
published_at: "2026-10-20T22:21:06+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T03:10:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91661", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91661", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Oracle Essbase: low-privilege HTTP attacker can read critical data

Oracle Essbase has a Security component flaw reachable over HTTP by a low-privileged user. Successful exploitation gives unauthorized access to critical data and, because of scope change, can reach other products.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:oracle essbase affected = 21.8.3.0.0 fixed ?

## How to check

- Confirm the installed Essbase release with the Oracle admin tooling; the affected version listed is `21.8.3.0.0`
- Check Oracle's Critical Patch Update advisory for the Essbase patch that matches your release: unknown

## Fix

- Apply the Oracle Critical Patch Update fix for Essbase; the fixed version is unknown from the sources
- Restrict HTTP access to Essbase to trusted networks until patched

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91661
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91661

## From the sources

Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_