Oracle Essbase CVE-2026-91653

Exploitation requires a valid low-privileged authenticated session on the Oracle Essbase Web Platform component (PR:L) with network HTTP access to the Essbase web interface; version 21.8.3.0.0 is the named affected build. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker must first possess or obtain low-privilege credentials, and the Essbase Web Platform HTTP endpoint must be network-reachable from the attacker - environments that restrict Essbase web access to trusted internal networks or that do not expose this component reduce realistic risk. Note the 'Authentication Bypass' tag conflicts with the authenticated (PR:L) requirement in the official vector.

This is a genuinely high-priority vulnerability by its intrinsic metrics, though exploitation-signal data is sparse. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, base 8.5) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with a scope change (S:C) indicating impact beyond the Essbase instance itself - a strong aggravating factor. Confidentiality impact is High (complete read access to Essbase-accessible data) with Low integrity impact (partial unauthorized update/insert/delete) and no availability impact. However, several exploitation signals are MISSING: no EPSS score was provided, so real-world exploitation probability cannot be quantified; the CVE is NOT in CISA KEV; and no public POC is referenced. There is also a conflict in the input: the 'Authentication Bypass' tag contradicts the CVSS vector's PR:L (which requires a valid low-privileged authenticated session), so the vulnerability is better characterized as a privilege-escalation/data-exposure flaw for authenticated users than a true pre-auth bypass - verify the intended behavior with Oracle's advisory. Net assessment: a real priority for any Essbase operator because of the low attack complexity, scope change, and high confidentiality impact, but current evidence points to it being a patch-now-on-schedule issue rather than an actively-exploited emergency, given the absence of KEV/POC/EPSS data.

An attacker who already holds a low-privileged account on the Oracle Essbase Web Platform sends crafted HTTP requests to an exposed Essbase interface, abusing the flaw to read all Essbase-accessible data and make limited unauthorized modifications. Because CVSS marks a scope change (S:C), the compromise can extend to additional products beyond Essbase itself. No public exploit identified at time of analysis, so exploitation would currently require independent weaponization.