Unauthenticated Access Vulnerability in Oracle Essbase from Oracle
CVE-2026-91650

3.7LOW

Key Information:

Vendor

Oracle
Status
Oracle Essbase
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91650?

A vulnerability in Oracle Essbase, specifically within the Java Based Agent component, permits an unauthenticated attacker with network access via HTTP to compromise the system. This flaw enables unauthorized read access to certain subsets of data within Oracle Essbase, posing significant risks to data confidentiality. Protecting against this vulnerability is critical, as it can be exploited easily by individuals seeking to gain access to sensitive data.

Affected Version(s)

Oracle Essbase 21.8.3.0.0

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.