Oracle Essbase CVE-2026-91648

Exploitation targets the Java Based Agent component of Oracle Essbase listening over TCP, reachable by a network attacker; per PR:N/UI:N no authentication or user interaction is required. The practical limiting factor is network exposure of the Essbase agent port - deployments that restrict the Essbase agent to internal/management networks or behind firewalls significantly reduce reachability. Impact is further bounded to read access of only a subset of Essbase data (C:L; no I/A impact), so the condition for meaningful harm is that sensitive data resides in the accessible subset. Affected configuration is confirmed only for version 21.8.3.0.0.

This is a moderate-severity confidentiality-only flaw (CVSS 3.1 base 5.3, vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) in the Java Based Agent component of Oracle Essbase 21.8.3.0.0. The CVSS signals favor the attacker on the access side - network vector (AV:N), low complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N), meaning a remote unauthenticated attacker can reach it over TCP against a default deployment. However, impact is deliberately constrained: only low confidentiality (C:L), with no integrity or availability impact (I:N/A:N) and an unchanged scope (S:U), limited to 'a subset of accessible data.' Counterbalancing signals temper the urgency: there is no EPSS score in the input, no CISA KEV listing, and no public POC, so there is no evidence of active or imminent exploitation. Net assessment: a credible but secondary priority - easy to exploit but low-value payoff (partial data read, no write or disruption). CONFLICT/CAVEAT: the input Tags include 'Authentication Bypass,' yet the description and CVSS describe unauthorized read of a data subset rather than a full authentication-control bypass - treat that tag as loosely applied and verify the exact technical nature with the Oracle CPU advisory before classifying this as an auth-bypass issue.

A remote attacker with network reachability to the Essbase Java Based Agent's TCP listener sends crafted requests directly, without any credentials, and retrieves a subset of Essbase data they should not be able to read. No user interaction or prior foothold is needed, but the exposure is limited to information disclosure. No public exploit code was identified at time of analysis.