Oracle Essbase CVE-2026-91640

Exploitation requires a valid low-privileged Oracle Essbase account (CVSS PR:L) with HTTP network reachability to the Essbase server; the affected release is version 21.8.3.0.0 and the flaw resides in the Security component. No user interaction is needed (UI:N) and complexity is low (AC:L). The principal limiting factors are the authentication requirement (not anonymous/pre-auth) and the read-only, subset-of-data confidentiality impact (I:N/A:N); the scope change (S:C) is what allows the disclosure to extend into additional products beyond Essbase itself.

This is a moderate-severity information-disclosure flaw (CVSS 3.1 base 5.0) in Oracle Essbase's Security component. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates it is network-reachable over HTTP, low-complexity, and requires no user interaction, but it DOES require an authenticated low-privileged account (PR:L) - so it is not a pre-auth or anonymous issue despite the 'Authentication Bypass' tag applied to it, which conflicts with the vector and appears mislabeled. Impact is limited to unauthorized read of a SUBSET of Essbase-accessible data (C:L, with I:N/A:N), though the scope change (S:C) means the confidentiality impact can reach beyond the Essbase component into additional products, which is what keeps the score at 5.0 rather than lower. Key exploitation signals are absent: no EPSS probability was provided, the CVE is NOT in CISA KEV, and no public POC is indicated - so there is no evidence of active exploitation or weaponization. Net assessment: a credentialed, read-only disclosure bug that is a routine patch-cycle item rather than an emergency; the low-privilege requirement and read-only/subset impact substantially cap real-world risk despite the network vector.

An attacker who already holds a low-privileged Essbase account (e.g., a legitimate but limited user, or one obtained via phishing/credential reuse) sends crafted HTTP requests to the Essbase Security component to read a subset of data they are not authorized to see, potentially reaching data in additional products due to the scope change. No public exploit code is identified at time of analysis, so exploitation would require independent research. Because attack complexity is low and no user interaction is needed, a motivated authenticated attacker could reliably reproduce it once the mechanism is understood.