EUVD-2026-106843
GHSA-wrf8-v53q-jjvv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged Essbase account
-
DeliverySend crafted HTTP request to Federated Partitions
-
ExploitExploit flaw crossing security scope
-
ExecutionAccess and modify protected data
-
ImpactImpact additional products / partial DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) network/HTTP reach to the Oracle Essbase instance and (2) a valid low-privileged Essbase account (PR:L) - it is NOT remotely unauthenticated despite the 'Authentication Bypass' tag. The specific affected surface is the Federated Partitions component on Oracle Essbase version 21.8.3.0.0; deployments not using that version are not in scope. No user interaction is needed (UI:N) and complexity is low (AC:L). The primary limiting factor is the authentication requirement: an attacker must first possess or obtain valid (even minimal) Essbase credentials, which bounds realistic risk below that of a fully anonymous flaw. |
| Impact | This is a genuine high-priority vulnerability by CVSS (9.1 Critical), driven largely by the scope change (S:C) and high confidentiality impact (C:H), with the vector confirming network attack (AV:N), low complexity (AC:L), low privileges required (PR:L), and no user interaction (UI:N). The signals are partly conflicting and partly absent: the Oracle tag set includes 'Authentication Bypass', yet the authoritative CVSS vector specifies PR:L, meaning a valid low-privileged account is required - this is NOT an unauthenticated bypass, and the tag appears to overstate the access requirement. No EPSS score, KEV listing, or public POC is present in the supplied data, so there is no evidence of active exploitation or weaponization - exploitation probability cannot be quantified from available signals and must be treated as unknown rather than low. The combination of network reachability, low privilege barrier, and scope change makes this a real patching priority for any organization running the affected Essbase version, but the authentication requirement (PR:L) meaningfully limits mass, drive-by exploitation compared to a true unauthenticated flaw. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged Oracle Essbase account sends crafted HTTP requests targeting the Federated Partitions component, leveraging the low-complexity flaw to read or alter data beyond their authorization. Because of the scope change (S:C), the compromise can extend to additional products beyond Essbase itself, and the attacker can also force a partial denial of service. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Low-privileged authenticated users can exploit the Federated Partitions component in Oracle Essbase 21.8.3.0.0 over HTTP to obtain broad read access to critical Essbase data, limited unauthorized insert/update/delete capability, and a partial denial of service. The critical 9.1 CVSS score is driven mainly by the scope change (S:C) and high confidentiality impact (C:H), meaning successful exploitation can also affect resources in connected products beyond Essbase itself. Attack complexity is low and no user interaction is required, but the flaw is not anonymously reachable - an attacker must already hold a valid low-privileged Essbase account (PR:L). No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied with the source data.
RemediationAI
Apply the fix published in the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the vendor's stated remediation channel for this Essbase issue; the available data does not specify an exact patched build number, so confirm the target version against that advisory before upgrading. Because exploitation requires only a low-privileged account, prioritize credential hygiene and least privilege in the interim: audit and prune Essbase user accounts, remove or restrict accounts with Federated Partitions access, rotate credentials for service and integration accounts, and alert on partition-related queries originating from unexpected hosts or accounts. Restrict HTTP access to the Essbase listener with network ACLs or a reverse proxy so only trusted application and administration subnets can reach it - this materially shrinks the attack surface but will break legitimate remote clients that connect directly. Where Federated Partitions is not actively used, disable or unconfigure the partition definitions and links; the trade-off is that cross-database and federated queries will stop working and any dependent reporting must be repointed. Monitor Essbase and downstream federated data sources for anomalous read volume or unexpected writes, since the scope change means impact may appear in connected products rather than on the Essbase host itself.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Essbase is a multidimensional OLAP engine, and its Federated Partitions capability links cubes across Essbase applications or to external relational sources so that queries and data appear as a single logical database. Partition metadata and federation endpoints are serviced over HTTP, which is the attack vector here (AV:N). The root cause falls into an access-control/authorization weakness class (no CWE was assigned by the reporting source) in which a caller holding only minimal Essbase privileges can reach partition operations that should require higher entitlement - the supplied 'Authentication Bypass' tag should be read in that light rather than as anonymous access, because the authoritative CVSS vector specifies PR:L. The S:C scope metric indicates the vulnerable component does not isolate its impact: data or operations reachable through a partition link can expose or alter content in the federated target, which is why the assessed confidentiality impact is High while integrity and availability are Low. The CPE data provided does not enumerate a platform string; the only confirmed in-scope build is Oracle Essbase 21.8.3.0.0.
Know when Essbase gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Network HTTP vector (AV:N), low complexity (AC:L), and a required low-privilege account (PR:L, not PR:N) with scope change (S:C) and high confidentiality but only partial integrity/availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in Oracle Essbase (component: Federated Partitions). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as unauthorized update, insert or delete access to some of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).
Executive ViewAI
Oracle Essbase’s Federated Partitions feature is a critical data-governance and availability risk for the organization: users who already have basic Essbase access could read sensitive business data, alter records within limits, and disrupt part of the service, with possible effects extending into connected applications. Leadership should treat this as a priority access-control and resilience issue because no vendor patch is available and the exposure is not anonymous but can be reached by any appropriately credentialed low-privilege user; no public exploit was identified at time of analysis.
No vendor-released patch identified at time of analysis; interim mitigations include restricting network access to Oracle Essbase 21.8.3.0.0 Federated Partitions, disabling the component where not required, enforcing least privilege and recertifying low-privileged accounts, monitoring for anomalous read/write and availability events, segmenting Essbase from connected products, maintaining offline backups, and monitoring Oracle advisories for a fixed release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verificatio
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcar
This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. Rat
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Acto
Oracle Essbase 21.8.3.0.0 (Security component) permits a low-privileged authenticated user to take full control of the E
Authenticated low-privileged attackers with network access to Oracle Essbase 21.8.3.0.0's T3/IIOP listeners can achieve
Remote takeover of Oracle Essbase 21.8.3.0.0 is possible for low-privileged authenticated attackers with HTTP network ac
Oracle Essbase 21.8.3.0.0 contains an easily exploitable flaw in its Security component that lets a low-privileged, netw
Exploit-DB