Oracle Essbase CVE-2026-91661

Requires a valid low-privileged account on an internet- or network-reachable Oracle Essbase 21.8.3.0.0 instance (PR:L), with HTTP access to the Essbase Security component; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The impact extends beyond Essbase due to the scope change (S:C), so connected downstream products may also expose data. LIMITING FACTORS: exploitation is not unauthenticated - the attacker must first obtain low-level credentials or an authenticated session - and impact is limited to data confidentiality only (no integrity or availability effect), which constrains realistic risk relative to the 7.7 score.

This is a moderately serious, confidentiality-only flaw (CVSS 3.1 7.7) in Oracle Essbase 21.8.3.0.0. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) indicates network-reachable exploitation over HTTP, low attack complexity, and only low privileges required (PR:L) - i.e. the attacker needs some valid, low-level authenticated access, not none. The scope change (S:C) combined with C:H is what elevates the score: Oracle states attacks 'may significantly impact additional products,' so a compromise can expose data beyond Essbase itself, though impact is strictly confidentiality (I:N/A:N - no data tampering or denial of service). Key exploitation-likelihood signals are MISSING from the input: no EPSS score, no CISA KEV listing, and no POC indicator were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. CONFLICTING SIGNAL: the input Tags include 'Authentication Bypass,' but the CVSS vector explicitly requires PR:L (a low-privileged authenticated attacker), which is inconsistent with a true authentication bypass - verify the exact mechanism against Oracle's CPU advisory. Net: a credible patch-soon priority for organizations running Essbase, but not an emergency relative to unauthenticated RCE-class issues, given the authentication requirement and absence of exploitation evidence.

An attacker who already holds a low-privileged Essbase account (or has pivoted to one) sends crafted HTTP requests to the Essbase Security component, abusing the flaw to read critical data they should not be able to access. Because the scope changes, the disclosed data may include information belonging to additional connected products, not just Essbase. No public exploit code is identified in the provided data, so this scenario is inferred from the CVSS vector rather than a demonstrated POC.