Oracle Essbase CVE-2026-91642

Exploitation requires network access to the Oracle Essbase HTTP service of an affected deployment running version 21.8.3.0.0; the flaw resides in the Security component. Per the CVSS vector (PR:N/UI:N/AC:L), no authentication, no user interaction, and no special configuration are needed - exploitation works against a reachable default instance. The primary limiting factors are network exposure (an Essbase instance restricted to an internal/management network is far less exposed than an internet-facing one) and version scope (confirmed affected version is 21.8.3.0.0; other versions are not enumerated in the input). Impact is inherently partial (C:L/I:L/A:L), bounding what a successful attack can read, alter, or disrupt.

This is a genuinely notable issue but not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base 7.3) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction - the most dangerous combination of access metrics - which is why Oracle rates it as 'easily exploitable.' However, every impact metric is only Low (partial confidentiality read on a subset of data, partial update/insert/delete, and partial DoS), so the ceiling on damage is bounded; there is no full-system compromise or total service outage implied. No EPSS score was supplied in the input, so exploitation probability cannot be quantified here. There is no CISA KEV listing and no public proof-of-concept referenced, so there is no evidence of active exploitation or automatable mass-exploitation at time of analysis. The access metrics and the impact metrics pull in different directions: trivial reachability argues for prompt patching, while the uniformly Low impacts argue against treating it as critical. Net: a real, patch-worthy priority for internet- or intranet-exposed Essbase instances, but not a drop-everything issue absent any exploitation signal. Note the only reference is the Oracle October 2026 CPU landing page, not a dedicated per-CVE advisory, so vendor-confirmed detail beyond the CVSS vector and affected version is limited.

An attacker with network reachability to the Oracle Essbase HTTP interface sends crafted requests to the vulnerable Security component without any credentials or user interaction. Because the flaw is low-complexity and unauthenticated, the attacker can read a subset of accessible data, tamper with (insert/update/delete) some data, and degrade availability with a partial denial of service. No public exploit code was identified at time of analysis.