Oracle Essbase CVE-2026-91650

Targets the Java Based Agent component of Oracle Essbase version 21.8.3.0.0, reachable over HTTP. Per the CVSS vector (AV:N/AC:L... actually AC:H/PR:N/UI:N), no authentication or user interaction is required, but exploitation is explicitly rated 'difficult' (AC:H), meaning success depends on specific conditions or timing not under the attacker's direct control. The impact is strictly limited to unauthorized read access to a subset of Essbase-accessible data - there is no integrity or availability impact - which caps the realistic consequence regardless of reachability. Primary limiting factors: high attack complexity and the requirement that a vulnerable Essbase 21.8.3.0.0 instance expose its HTTP agent interface to the attacker.

This is a genuinely low-priority issue despite being network-reachable and unauthenticated. The CVSS 3.1 base score is only 3.7, driven entirely by a limited confidentiality impact (C:L, I:N, A:N) - an attacker can read only 'a subset of Oracle Essbase accessible data' with no write or availability effect. Two factors strongly suppress real-world risk: AC:H (high attack complexity), meaning Oracle itself rates the vulnerability as 'difficult to exploit' and requiring conditions outside the attacker's control, and the narrow, read-only technical impact. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. One conflict to verify: the input Tags include 'Authentication Bypass,' but the Oracle description characterizes this purely as unauthorized read access to a data subset, not a bypass of authentication controls - the tag appears inconsistent with the described impact and should be verified against the Oracle CPU advisory. Net: a real but low-severity information-disclosure flaw, appropriate for routine patch-cycle remediation rather than emergency response.

A remote, unauthenticated attacker sends crafted HTTP requests to the Java Based Agent component of an internet- or network-reachable Oracle Essbase 21.8.3.0.0 instance and, under specific hard-to-meet conditions (AC:H), coaxes the service into returning a limited subset of Essbase-accessible data. No public exploit code was identified in the provided data, and the high complexity means reliable exploitation is non-trivial.