Oracle Essbase Federated Partitions Flaw Rated Critical by NVD
A critical vulnerability in Oracle Essbase version 21.8.3.0.0 allows network-based attackers to compromise the system with low privileges.
Key points
- The flaw is tracked as CVE-2026-91656 and carries a CVSS score of 9.1.
- It affects the Federated Partitions component of Oracle Essbase.
- Attackers with network access via HTTP can exploit the vulnerability easily.
The National Vulnerability Database has published a record for CVE-2026-91656, a critical security flaw in Oracle Essbase. This vulnerability exists within the Federated Partitions component of the software. The issue allows low-privileged attackers with network access to compromise the system via HTTP.
The National Vulnerability Database rates the severity of this flaw as critical with a CVSS 3.1 Base Score of 9.1. The vector string indicates that the attack is network-based and requires low complexity. Attackers do not need user interaction to exploit the issue. The vulnerability affects Oracle Essbase version 21.8.3.0.0 specifically.
Context and Background
The flaw allows for unauthorized access to critical data within the affected Oracle Essbase instances. According to the NVD record, successful exploitation can also result in unauthorized updates, inserts, or deletions of accessible data. The vulnerability impacts confidentiality, integrity, and availability metrics simultaneously.
Although the vulnerability resides in Oracle Essbase, the NVD notes that attacks may significantly impact additional products. This is due to a scope change in the security assessment. The low privilege requirement for attackers makes the threat particularly concerning for network-exposed systems.
Who Is Affected
Organizations running Oracle Essbase version 21.8.3.0.0 are directly affected by this vulnerability. The flaw is located in the Federated Partitions component of the application. Users who have exposed the HTTP interface to untrusted networks face the highest risk.
The NVD describes the vulnerability as easily exploitable. This means that attackers do not need specialized conditions or high-level privileges to initiate an attack. The low complexity rating suggests that automated tools could potentially identify and exploit the issue.
What should you do?
Security teams should verify if their environments include Oracle Essbase version 21.8.3.0.0. Inventory checks should focus on the Federated Partitions component specifically. Organizations should monitor network traffic for unusual HTTP requests targeting this service.
What to do and how to stay safe: Oracle Essbase
- Audit all Oracle Essbase installations to confirm if version 21.8.3.0.0 is in use.
- Restrict network access to the HTTP interface of Oracle Essbase to trusted sources only.
- Monitor logs for unauthorized data access or modification attempts on the system.
- Wait for official vendor guidance before applying any unverified patches or workarounds.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-91656?
The CVSS 3.1 Base Score is 9.1, which is rated as critical severity.
Which component of Oracle Essbase is affected?
The vulnerability is located in the Federated Partitions component of Oracle Essbase.
Is user interaction required to exploit this flaw?
No, the CVSS vector indicates that no user interaction is required for exploitation.
