Oracle Essbase CVE-2026-91655

Exploitation requires the attacker to already possess low-privileged authenticated access to Oracle Essbase 21.8.3.0.0 and network reachability to its HTTP interface (AV:N, PR:L, AC:L, UI:N). The flaw resides specifically in the Essbase Security component. The key amplifying condition is the scope change (S:C): a successful attack can reach beyond Essbase itself to significantly impact additional connected products, broadening the blast radius. The principal limiting factors are the credential requirement (not remotely exploitable by a fully unauthenticated attacker) and the restriction to the specific affected version 21.8.3.0.0; no special non-default configuration or user interaction is indicated as necessary.

This is a genuinely high-priority issue despite several intelligence gaps. The CVSS 3.1 base score of 9.1 is driven primarily by the scope change (S:C) combined with network exploitability (AV:N), low attack complexity (AC:L), no user interaction (UI:N), and high confidentiality impact (C:H), with lower integrity and availability impact (I:L/A:L). Crucially, the vector specifies PR:L, meaning exploitation requires some level of authentication - the attacker must already hold low-privileged credentials, which is a meaningful mitigating factor against purely opportunistic internet-wide exploitation. No EPSS probability was provided, the CVE is NOT on the CISA KEV list, and no public POC is referenced, so there is no evidence of active exploitation or weaponization at this time; the elevated score reflects potential impact, not observed attack activity. There is also a notable conflict in the metadata: the input carries an 'Authentication Bypass' tag, yet both the description ('low privileged attacker') and the CVSS vector (PR:L) indicate that valid credentials are required - this is inconsistent and should be verified against Oracle's CPU advisory, as a true authentication bypass would warrant PR:N and a different risk profile. Treat this as a high-severity, credentialed, network-reachable flaw with cross-product (scope-change) blast radius: prioritize patching, but recognize the authentication precondition tempers real-world mass-exploitation risk relative to the raw 9.1 score.

An attacker who has obtained low-privileged Essbase credentials (e.g., a standard application account, or credentials from phishing or reuse) sends crafted HTTP requests to the Essbase Security component over the network. Because of the scope change, the attacker is able to read critical data across the Essbase instance and partially modify or disrupt data in additional connected products. No public exploit code has been identified at the time of analysis, so this scenario is inferred from the CVSS vector rather than a demonstrated POC.