Oracle Essbase CVE-2026-91630

Exploitation requires an attacker who already holds a HIGH-PRIVILEGED account on Oracle Essbase (PR:H) reaching the Essbase Security component over the network via HTTP; the specifically named affected build is version 21.8.3.0.0. No user interaction is needed (UI:N) and complexity is low (AC:L), but the mandatory pre-existing high-privilege authentication is the primary limiting factor, meaning this cannot be triggered by an unauthenticated or low-privileged remote attacker. The scope change (S:C) means successful exploitation can expose confidential data in additional connected products beyond Essbase itself.

This is a moderate-priority issue whose raw CVSS 3.1 base score of 6.8 is inflated by the scope-change metric (S:C) rather than by ease of exploitation. The decisive gating factor is PR:H: the Oracle CVSS vector and description agree that the attacker must already be a 'high privileged' Essbase user, so this is not a path for an unauthenticated outsider. Partially offsetting that, AV:N/AC:L/UI:N mean that once such privileges are held, exploitation over HTTP is reliable and requires no victim interaction, and the scope change plus C:H (I:N/A:N) means confidentiality of data in both Essbase and additional connected products is at stake while integrity and availability are not. No EPSS score, CISA KEV listing, POC, SSVC decision data, or CWE were supplied, so there is no evidence of active exploitation or automatability - status is no public exploit identified at time of analysis. One conflict must be flagged: the input Tag 'Authentication Bypass' directly contradicts the PR:H vector and the 'high privileged attacker' description, since a genuine auth bypass would be PR:N - treat that tag as unreliable and do not downgrade the privilege prerequisite based on it. Net: a real but not urgent fix, best prioritized as a privilege-escalation / data-exposure hardening item rather than an emergency.

An attacker who already holds a high-privileged Oracle Essbase account (for example a rogue administrator or an account compromised via other means) sends crafted HTTP requests to the Essbase Security component. Because the flaw causes a scope change, the attacker gains unauthorized read access to critical data not only within Essbase but across additional connected Oracle products. No public exploit code is identified at time of analysis, and no user interaction is required.