Oracle Essbase CVE-2026-91641

Exploitation requires the attacker to already possess a valid low-privileged account on Oracle Essbase 21.8.3.0.0 (PR:L), reachable over the network via HTTP against the Security component. No user interaction and no elevated privileges are needed, and attack complexity is low. The primary limiting factors are the authentication prerequisite (a credentialed low-privilege session is mandatory) and the restricted outcome - only read access to a subset of data, with no write/integrity or availability impact. The scope change means the disclosure can affect additional products beyond Essbase, so impact depends on how Essbase is integrated with other systems in the deployment.

This is a medium-severity issue (CVSS 3.1 base 5.0) that should be patched in Oracle's normal cycle rather than treated as an emergency. The vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) indicates network-reachable, low-complexity exploitation, but it requires an already-authenticated low-privileged account (PR:L), and the only impact is limited, read-only disclosure of a subset of Essbase data (C:L, I:N, A:N). The scope change (S:C) raises the score because the disclosure can reach beyond the vulnerable component into other products, which is the main reason this is not simply a low. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or imminent exploitation; exploitation status is therefore 'no public exploit identified at time of analysis.' A notable conflict exists: the input Tags include 'Authentication Bypass,' yet the CVSS vector requires PR:L and the description explicitly describes a 'low privileged attacker' obtaining 'unauthorized read access,' which is an information-disclosure/privilege-boundary issue, not an unauthenticated authentication bypass - the tag appears mislabeled and should be verified against Oracle's advisory. Overall this is a real but moderate-priority item: the authentication prerequisite and read-only, partial-confidentiality impact meaningfully limit real-world risk despite the network vector.

An attacker who already holds a low-privileged Essbase account sends crafted HTTP requests to the Security component and obtains unauthorized read access to a subset of Essbase data, with the scope change allowing that disclosure to extend to additional connected products. No public exploit code was identified in the provided data, and no user interaction is required, but valid low-level credentials are a prerequisite.