Oracle Essbase CVE-2026-91658

Exploitation requires network access to the Oracle Essbase HTTP interface and a low-privilege authenticated session (PR:L) against affected version 21.8.3.0.0 - it is NOT fully unauthenticated. Within those bounds there are no further special conditions: no user interaction is needed (UI:N) and attack complexity is low (AC:L), so any attacker holding even minimal Essbase credentials and HTTP reachability can exploit it. The primary limiting factors are (1) the need for valid low-level credentials and (2) network exposure of the Essbase service; environments that restrict Essbase to trusted internal networks and tightly control account provisioning materially reduce exposure. The scope change (S:C) means successful exploitation may extend impact to additional connected products.

This is a high-priority vulnerability. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 9.9) describes network-reachable exploitation over HTTP with low attack complexity, no user interaction, and only low-level privileges required (PR:L), culminating in full confidentiality, integrity, and availability compromise plus a scope change (S:C) that Oracle states may significantly impact additional products. The combination of AC:L, UI:N, and a scope change driving the near-maximal 9.9 score indicates a genuinely dangerous flaw rather than a CVSS-inflated edge case. However, several key signals are MISSING from the input: no EPSS exploitation-probability score is provided, there is no CISA KEV listing in the data, and no POC/exploit code is referenced - so this assessment rests on the CVSS vector and Oracle's narrative alone. No SSVC decision values were supplied. The one notable inconsistency is the 'Information Disclosure' tag, which understates a vulnerability whose vector asserts full I and A impact and 'takeover'; treat the tag as incomplete, not the vector. Net: prioritize patching because exploitation is easy and impact is total, but note that real-world exploitation likelihood is currently UNQUANTIFIED due to absent EPSS/KEV/POC data.

An attacker who already holds a low-privilege Essbase account (PR:L) sends crafted HTTP requests to the Essbase Security component over the network, with no user interaction and low complexity, to escalate to full control of the server. Because the scope changes (S:C), the compromise can pivot to impact additional connected Oracle products beyond Essbase itself. No public exploit code is referenced in the available data.