Oracle Essbase CVE-2026-91644

Exploitation requires network reachability to the Oracle Essbase HTTP service on a host running the affected build 21.8.3.0.0; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no special privileges, and no user interaction are needed against a reachable instance. The flaw resides in the Essbase Security component and carries a scope change (S:C), so impact may extend to additional connected Oracle products. The primary limiting factor is exposure of the Essbase HTTP interface - instances isolated behind network segmentation, not internet-facing, or restricted by upstream access controls are substantially less exposed; the vendor identifies only version 21.8.3.0.0 as affected, so deployments on other versions may not be vulnerable.

Signals are strongly aligned toward high priority, with one caveat: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N, base 9.3) describes the worst-case exposure profile - remote, network-reachable over HTTP, low attack complexity, no privileges and no user interaction, with a scope change that lets the compromise reach beyond Essbase itself. The dominant impact is confidentiality (C:H) with limited integrity (I:L) and no availability impact (A:N), so this is primarily a data-exposure/unauthorized-access flaw rather than a service-disruption one. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or weaponization - the 9.3 reflects potential severity, not observed activity. The 'Authentication Bypass' tag is directionally consistent with PR:N (unauthenticated) but is not independently corroborated by the Oracle description, which only states 'unauthenticated attacker'; treat the bypass framing as unconfirmed. Net: a genuinely high-priority patch target for any organization running the affected Essbase build because of the trivial unauthenticated network reach and scope change, but the absence of KEV/EPSS/POC signals means exploitation is currently theoretical and likely not yet widespread - prioritize patching without assuming imminent mass exploitation.

A remote, unauthenticated attacker who can reach the Oracle Essbase HTTP interface sends a crafted request to the vulnerable Security component, requiring no credentials, no user interaction, and only low attack complexity. Because of the scope change, successful exploitation yields read access to critical Essbase data and limited unauthorized modification, and may extend impact into additional connected products. No public exploit code was identified at time of analysis.