EUVD-2026-106826
GHSA-q6m7-6mc8-xx9m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege Essbase account
-
ExploitSend crafted HTTP request to Security component
-
ExecutionExploit flaw to escalate data access
-
ImpactRead all Essbase and scope-adjacent product data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged account on Oracle Essbase (PR:L) with network HTTP access to the Essbase service; the affected release is 21.8.3.0.0. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The key limiting factor is that the attacker must already be authenticated with at least low privileges - this is not exploitable by a fully unauthenticated attacker despite the 'Authentication Bypass' tag. The scope change (S:C) means a successful attack can impact data in additional products beyond Essbase itself. |
| Impact | This is a CVSS 3.1 7.7 (High) flaw in Oracle Essbase's Security component, scored AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - network-reachable over HTTP, low attack complexity, requiring only low privileges, no user interaction, with a scope change and high confidentiality impact (integrity and availability unaffected). No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence, so there is no evidence of active exploitation or weaponization; the only data signal elevating this above baseline is the easy exploitability (AC:L/PR:L) plus scope change, which means a compromise can cascade into other products beyond Essbase itself. The 'Authentication Bypass' tag conflicts with the CVSS vector's PR:L (which requires a valid low-privileged account), so the vulnerability most likely enables privilege/data-access escalation for an already-authenticated user rather than a true pre-auth bypass - verify the exact nature with Oracle. On balance this is a credible but not emergency priority: a pure-confidentiality, auth-required flaw in a specialized product with no exploitation evidence, warranting prompt patching in the Oracle October 2026 CPU cycle but not ahead of any network-reachable unauthenticated or actively-exploited issues. |
| Exploit ScenarioDerived | An attacker with a low-privileged but valid Essbase account sends crafted HTTP requests to the Essbase server and abuses a flaw in the Security component to read critical data they should not have access to. Because the vulnerability carries a scope change, the exposure can extend to data in additional connected Oracle products, not just Essbase. No public exploit code has been identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Low-privileged authenticated users of Oracle Essbase 21.8.3.0.0 can exploit the Security component over HTTP to obtain unauthorized access to critical data, potentially extending beyond Essbase because of a scope change. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N: no user interaction is needed, but the attacker must already hold a valid low-privilege account and network access to the Essbase service. No public exploit was identified at time of analysis, and the 'Authentication Bypass' tag should not be read as allowing fully unauthenticated access given PR:L.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html) to Oracle Essbase 21.8.3.0.0; the provided data does not specify an exact fixed build, so verify the patched version in the advisory before deployment. Until patched, restrict HTTP access to the Essbase service to trusted networks or application tiers, recognizing that this may break legitimate remote clients, and review or limit low-privileged accounts to only the data they require while monitoring for anomalous read-heavy queries or access to critical cubes. Because of the scope change, also review downstream products that trust Essbase identities or data for exposure; these controls are compensating only and do not remove the underlying flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Essbase is a multidimensional OLAP server used for analytical applications, and the affected component is its Security layer reachable over HTTP. The CVSS vector's PR:L is decisive: exploitation requires a valid low-privileged account, so this is better characterized as an authenticated data-exposure or privilege-boundary failure in the Security component rather than a pre-authentication bypass. The S:C scope change means a successful attack can affect resources beyond Essbase itself, such as integrated products or downstream systems that trust Essbase identities or data. The root-cause class cannot be mapped because no CWE is provided; the impact is confidentiality-only, with integrity and availability unaffected.
Know when Essbase gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Network HTTP vector (AV:N), low complexity (AC:L), requires a low-privileged authenticated account (PR:L), scope change to other products (S:C); confidentiality-only impact (C:H, I:N, A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Executive ViewAI
Oracle Essbase 21.8.3.0.0 contains a high-severity confidentiality flaw that allows an existing low-privilege user to access critical data, with a scope change indicating exposure may extend beyond Essbase into connected systems. No public exploit identified at time of analysis, but no vendor-released patch identified at time of analysis and the service may be broadly accessible to internal users. Leadership should prioritize access governance, network restriction, and monitoring of Essbase data access until a fix is available.
No vendor-released patch identified at time of analysis: restrict HTTP access to Oracle Essbase 21.8.3.0.0, enforce least privilege and review low-privilege accounts, monitor and alert on Security component and anomalous data-access activity, segment Essbase from downstream systems, and apply the vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verificatio
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcar
This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. Rat
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Acto
Oracle Essbase 21.8.3.0.0 (Security component) permits a low-privileged authenticated user to take full control of the E
Authenticated low-privileged attackers with network access to Oracle Essbase 21.8.3.0.0's T3/IIOP listeners can achieve
Remote takeover of Oracle Essbase 21.8.3.0.0 is possible for low-privileged authenticated attackers with HTTP network ac
Oracle Essbase 21.8.3.0.0 contains an easily exploitable flaw in its Security component that lets a low-privileged, netw
Exploit-DB