Vulnerability in Oracle Essbase Security Affecting Oracle Corporation
CVE-2026-91640

5MEDIUM

Key Information:

Vendor

Oracle
Status
Oracle Essbase
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91640?

A security vulnerability exists in Oracle Essbase, allowing a low-privileged attacker with network access via HTTP to exploit the system. This vulnerability could lead to unauthorized read access to certain data within Oracle Essbase, potentially impacting additional associated products. Organizations using Oracle Essbase version 21.8.3.0.0 should take immediate action to assess and mitigate the risks related to this vulnerability. For more information, consult the Oracle Advisory for the recommended patches and remediation steps.

Affected Version(s)

Oracle Essbase 21.8.3.0.0

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.