Unauthorized Access Vulnerability in Oracle Essbase Security
CVE-2026-91646

5.6MEDIUM

Key Information:

Vendor

Oracle
Status
Oracle Essbase
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91646?

A vulnerability exists in Oracle Essbase's security component, affecting version 21.8.3.0.0. This weakness allows an unauthenticated attacker with network access via T3 or IIOP protocols to exploit the system. Successful exploitation could lead to unauthorized updates, inserts, or deletions of accessible data within Oracle Essbase. Furthermore, attackers may gain unauthorized read access to certain data, leading to potential confidentiality breaches. Additionally, this vulnerability could enable a partial denial of service, impacting the availability of Oracle Essbase services. Proper security measures should be established to mitigate these risks.

Affected Version(s)

Oracle Essbase 21.8.3.0.0

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
5.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.