Security Flaw in Oracle Essbase Security Component
CVE-2026-91661

7.7HIGH

Key Information:

Vendor

Oracle
Status
Oracle Essbase
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91661?

A security vulnerability exists in Oracle Essbase affecting version 21.8.3.0.0, which may be exploited by low-privileged attackers with network access via HTTP. This vulnerability allows attackers to compromise Oracle Essbase, potentially leading to unauthorized access to critical data. The exploitation of this flaw can impact additional products, thereby broadening the scope of the threats posed. Organizations utilizing Oracle Essbase should take immediate steps to assess their security posture and mitigate potential risks associated with this vulnerability.

Affected Version(s)

Oracle Essbase 21.8.3.0.0

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.