Oracle Essbase CVE-2026-91633

Exploitation requires the attacker to already possess high-privileged authenticated logon (PR:H) to the operating-system infrastructure hosting Oracle Essbase version 21.8.3.0.0 - it is not remotely reachable (AV:L) and needs no user interaction (UI:N). The specific affected subsystem is the Essbase 'Security' component. Limiting factors: local access plus pre-existing high privileges are mandatory, which confines realistic exploitation to malicious insiders or an attacker who has already compromised a privileged account on the host; there is no network-facing exposure and no default-configuration remote vector. The scope change (S:C) means a successful attack can reach data in additional products beyond Essbase.

This is a moderate-severity, low-urgency issue. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, base 6.0) makes the core constraint explicit: exploitation is LOCAL (AV:L) and requires HIGH privileges (PR:H) - an attacker must already have authenticated administrative/high-privilege logon to the infrastructure where Oracle Essbase runs. That high bar sharply limits real-world risk despite the 'easily exploitable' language (which reflects AC:L, not a lack of access prerequisites). Impact is confidentiality-only (C:H, I:N, A:N), with a scope change (S:C) indicating the compromise can affect additional products beyond Essbase itself. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. CONFLICTING SIGNAL: the input Tag 'Authentication Bypass' contradicts the CVSS vector and description - a PR:H local flaw is the opposite of an authentication bypass, so that tag appears mislabeled and should not drive prioritization. Net: a real but lower-tier patch item (privileged insider or post-compromise lateral/scope-change concern), not an internet-facing emergency.

An attacker who already holds high-privileged logon access to the host running Oracle Essbase 21.8.3.0.0 leverages the Security-component flaw locally to read critical data they should not be able to access. Because of the scope change, the same action may expose data belonging to additional products sharing the environment. No public exploit code is known, so this would require a bespoke technique by an already-privileged user.