Oracle Essbase CVE-2026-91643

Requires network reachability to the Oracle Essbase Java-based Agent HTTP interface on the affected supported version 21.8.3.0.0; no authentication, credentials, or user interaction are needed (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is exposure of the Essbase Agent HTTP endpoint to the attacker's network - deployments that restrict the agent to trusted internal segments or behind network controls substantially reduce reachability. Impact is bounded to unauthorized read access to a subset of Essbase data, with no write, modification, or denial-of-service capability.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3 MEDIUM) describes a remotely reachable, low-complexity, unauthenticated flaw with no user interaction, but its impact is deliberately narrow - low confidentiality only, with no integrity or availability consequence and no scope change. This means an attacker can read 'a subset of' Essbase-accessible data over HTTP but cannot modify data, disrupt service, or pivot. No EPSS score, CISA KEV listing, POC, or SSVC decision data was supplied, so exploitation-likelihood signals are entirely absent; based on available data this is no public exploit identified at time of analysis. The realistic priority is MODERATE-to-LOW: easy to trigger if the Essbase Java-based Agent HTTP endpoint is network-exposed, but the bounded read-only impact makes it an information-disclosure issue rather than a full compromise despite the 'compromise Oracle Essbase' phrasing in Oracle's standardized advisory language. Note a labeling inconsistency: the input Tags include 'Authentication Bypass,' yet the description and C:L/I:N/A:N vector describe unauthorized information disclosure, not a true authentication bypass - treat the tag with caution and verify against the Oracle CPU advisory.

An attacker with network access to the Oracle Essbase Java-based Agent HTTP interface sends crafted unauthenticated requests to the exposed endpoint and retrieves a subset of Essbase-accessible data without any credentials or user interaction. Because the flaw is low-complexity and requires no privileges, exploitation is straightforward wherever the agent is reachable, though the attacker gains only read access to a limited data subset. No public exploit code or active exploitation has been identified in the provided intelligence.