Vulnerability in Oracle Essbase Security Component
CVE-2026-91652

5MEDIUM

Key Information:

Vendor

Oracle
Status
Oracle Essbase
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91652?

A vulnerability exists in the security component of Oracle Essbase, specifically affecting version 21.8.3.0.0. This vulnerability is easily exploitable by a low privileged attacker who has network access via HTTP. Successful exploitation can lead to unauthorized read access to certain data hosted within Oracle Essbase, posing a serious risk to data confidentiality. Since the vulnerability impacts the broader scope of affected products, it is crucial for organizations using Oracle Essbase to take immediate measures to secure their environments.

Affected Version(s)

Oracle Essbase 21.8.3.0.0

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.