EUVD-2026-106844
GHSA-7f26-c48v-p9xf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged Essbase account
-
ExploitSend crafted HTTP request to Security component
-
ExecutionBypass access control on data subset
-
ImpactRead unauthorized confidential data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privileged authenticated account on Oracle Essbase 21.8.3.0.0 (PR:L) with network HTTP reachability to the Essbase Security component; no user interaction is needed and complexity is low. The limiting factors are the authentication requirement (not exploitable by fully unauthenticated attackers) and the confined outcome - only read access to a subset of Essbase data, with no write/modify or availability impact. Only the single affected version 21.8.3.0.0 is named in the advisory. |
| Impact | This is a genuinely low-to-moderate priority issue despite being network-exploitable. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3 MEDIUM) shows a low-complexity, network-reachable flaw over HTTP, but it requires an already-authenticated low-privileged account (PR:L) and yields only partial confidentiality impact (C:L) with no integrity or availability effect - so it is an information-disclosure bug, not a system takeover. There is no CISA KEV listing, no POC referenced, and no EPSS score supplied in the input, so there is no signal of active or imminent exploitation; status is 'no public exploit identified at time of analysis.' Note a conflict in the metadata: the input carries an 'Authentication Bypass' tag, but the CVSS vector requires privileges (PR:L) and the description explicitly states a 'low privileged attacker' with only read access - this is NOT an authentication bypass, and the tag appears mislabeled. The data originates solely from Oracle's October 2026 Critical Patch Update advisory; no independent NVD CVSS, CWE, or third-party confirmation is present, so prioritization should reflect a patch-on-normal-cycle disclosure rather than an emergency. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged authenticated account on an Oracle Essbase 21.8.3.0.0 instance sends crafted HTTP requests to the Security component and reads a subset of Essbase data they should not be able to access. No user interaction is required and attack complexity is low, but valid low-level credentials are a prerequisite. No public exploit code has been identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Oracle Essbase 21.8.3.0.0 has a Security-component flaw that allows a low-privileged authenticated attacker with HTTP network access to read a limited subset of Essbase data; the only impacted dimension is confidentiality, giving CVSS 3.1 score 4.3. Exploitation is low-complexity and requires no user interaction, but it is not open to fully unauthenticated outsiders because a valid low-privileged account is needed. No public exploit code or confirmed active exploitation was identified at time of analysis, and the supplied advisory does not name any affected version other than 21.8.3.0.0.
RemediationAI
Apply the Oracle Critical Patch Update fix for the Essbase Security component affecting 21.8.3.0.0, following the October 2026 CPU advisory at https://www.oracle.com/security-alerts/cpuoct2026.html. The supplied data does not include an exact patched build number, so use the vendor-listed replacement version rather than assuming one. Until the patch is applied, restrict network access to Essbase HTTP interfaces to trusted networks and users, enforce least privilege, and review accounts that can reach the Security component; these controls reduce exposure but do not remove the flaw and can disrupt legitimate remote access if scoped too narrowly. No vendor-specific workaround is provided in the available data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is in Oracle Essbase's Security component, which governs authentication, authorization, and access to Essbase data exposed over HTTP. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N describes a network-reachable, low-complexity attack that requires a low-privileged account and yields only limited confidentiality loss, with no integrity or availability impact. Oracle's advisory does not assign a CWE root-cause class in the supplied data, and the 'Authentication Bypass' tag should be read alongside the PR:L vector: exploitation still depends on a valid low-privileged account or session rather than being available to unauthenticated users. The sole named affected release is 21.8.3.0.0.
Know when Essbase gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network HTTP vector with low complexity but a required low-privileged account (PR:L), no user interaction, and partial confidentiality only (C:L), with no integrity or availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verificatio
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcar
This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. Rat
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Acto
Oracle Essbase 21.8.3.0.0 (Security component) permits a low-privileged authenticated user to take full control of the E
Authenticated low-privileged attackers with network access to Oracle Essbase 21.8.3.0.0's T3/IIOP listeners can achieve
Remote takeover of Oracle Essbase 21.8.3.0.0 is possible for low-privileged authenticated attackers with HTTP network ac
Oracle Essbase 21.8.3.0.0 contains an easily exploitable flaw in its Security component that lets a low-privileged, netw
Exploit-DB