Oracle Essbase CVE-2026-91636

Exploitation requires the attacker to hold a valid low-privilege account on Oracle Essbase 21.8.3.0.0 and network access to the HTTP interface of the Security component (PR:L, AV:N, AC:L, UI:N). No user interaction and no high-privilege/admin role is needed. The primary limiting factor is the authentication requirement - an attacker must first obtain low-privilege credentials or an existing account; this is not a remote unauthenticated flaw despite the 'Authentication Bypass' tag. The scope change (S:C) means a successful attack can extend disclosure beyond Essbase to additional connected Oracle products, so network-segmentation and access controls around Essbase are the relevant defensive levers.

This is a genuinely elevated-priority issue rather than a CVSS-inflated one, but the signals are incomplete. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with a scope change that lets a compromise of Essbase reach 'additional products' - a serious lateral-impact signal. However, the impact is confidentiality-only (C:H, I:N, A:N): this is a data-disclosure flaw, not a path to code execution or service disruption. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no exploitation-probability or active-exploitation evidence to corroborate the theoretical ease of attack; per the precision rules this is 'no public exploit identified at time of analysis.' A notable conflict exists in the metadata: the input carries an 'Authentication Bypass' tag, yet both the description ('low privileged attacker') and the CVSS vector (PR:L) indicate the attacker must already hold a low-privilege authenticated account - this is NOT an unauthenticated bypass, so the tag appears mislabeled and should not be used to escalate urgency. Net: prioritize patching for internet- or widely-exposed Essbase instances because of the easy, authenticated-but-low-bar network vector and the scope change, but recognize the absence of exploitation signals (EPSS/KEV/POC) means widespread active exploitation is not currently evidenced.

A low-privileged user with a valid Essbase account (or an attacker who has phished/obtained such credentials) sends crafted HTTP requests to the Essbase Security component over the network, with no user interaction required. Because the attack is low-complexity and causes a scope change, the attacker gains unauthorized read access to all Essbase-accessible data and can leverage the scope change to expose data in additional connected products. No public exploit code was identified at the time of analysis.