Security Vulnerability in Oracle Essbase by Oracle
CVE-2026-91638

9.9CRITICAL

Key Information:

Vendor

Oracle
Status
Oracle Essbase
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91638?

A security vulnerability exists in Oracle Essbase that allows an attacker with low privileges and network access via HTTP to exploit the system. This vulnerability primarily affects version 21.8.3.0.0, and while it originates within Oracle Essbase, it may have broader implications for other connected products. Successful exploitation can potentially lead to unauthorized access and control over Oracle Essbase, compromising confidentiality, integrity, and availability.

Affected Version(s)

Oracle Essbase 21.8.3.0.0

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.