Critical Oracle Essbase Flaw Allows Low-Privilege Attackers Full Data Access
A CVSS 9.1 vulnerability in Oracle Essbase 21.8.3.0.0 enables network-based attackers to compromise security and access critical data.
Key points
- Oracle Essbase 21.8.3.0.0 contains a critical security flaw rated 9.1 on the CVSS scale.
- Attackers with low privileges and network access via HTTP can exploit the vulnerability easily.
- Successful exploitation results in unauthorized data access, modification, and partial denial of service.
The National Vulnerability Database has recorded a critical security flaw in Oracle Essbase that allows attackers to compromise the system with ease. Identified as CVE-2026-91655, the vulnerability carries a CVSS 3.1 Base Score of 9.1, indicating severe risk to confidentiality, integrity, and availability.
This defect resides within the Security component of Oracle Essbase version 21.8.3.0.0. According to the NVD record, the issue is easily exploitable by a low-privileged attacker who has network access via HTTP. The high severity rating reflects the significant impact a successful attack can have on the system.
Technical Scope and Impact
The vulnerability allows an attacker to gain unauthorized access to critical data or complete access to all Oracle Essbase accessible data. Beyond reading information, the flaw permits unauthorized update, insert, or delete operations on some accessible data. Attackers can also cause a partial denial of service, disrupting system availability.
The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) highlights that the attack vector is network-based with low complexity and no user interaction required. Although the vulnerability is in Oracle Essbase, the NVD notes that attacks may significantly impact additional products due to scope change.
Affected Systems and Risk Profile
Only Oracle Essbase version 21.8.3.0.0 is listed as the supported version affected by this specific vulnerability. Organizations running this release are exposed to the risk of unauthorized data compromise. The ease of exploitation means that basic network access is sufficient for an attacker to attempt an intrusion.
The combination of high confidentiality impact and low privilege requirements makes this a significant threat to enterprises relying on Essbase for data management. The potential for data modification and deletion adds to the operational risk, as attackers can alter or remove critical information.
What should you do?
Security teams should immediately verify if Oracle Essbase 21.8.3.0.0 is deployed in their environments. Since the vulnerability is easily exploitable via HTTP, restricting network access to the service is a critical mitigation step. Organizations should monitor for unusual activity that may indicate an ongoing exploitation attempt.
What to do and how to stay safe: Oracle
- Inventory all systems to identify instances of Oracle Essbase version 21.8.3.0.0.
- Restrict network access to the Oracle Essbase service to trusted IP ranges only.
- Monitor logs for unauthorized HTTP requests or unusual data modification patterns.
- Prepare to apply updates once Oracle releases a patch for CVE-2026-91655.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which version of Oracle Essbase is affected by CVE-2026-91655?
Only Oracle Essbase version 21.8.3.0.0 is listed as the supported version affected by this vulnerability.
What is the severity rating of this vulnerability?
The vulnerability has a CVSS 3.1 Base Score of 9.1, which is rated as Critical.
Can this vulnerability be exploited remotely?
Yes, it can be exploited by a low-privileged attacker with network access via HTTP.
