Oracle Essbase CVE-2026-91662

Exploitation requires the attacker to already have an interactive low-privileged logon on the server infrastructure where Oracle Essbase 21.8.3.0.0 executes (AV:L, PR:L) and to interact with the Java Based Agent component; no victim user interaction is needed (UI:N). The primary limiting factors are: (1) local access is mandatory - this cannot be triggered by an unauthenticated remote attacker over the network; (2) high attack complexity (AC:H) implies a condition outside the attacker's control (e.g., timing/race or a specific state) must be met, reducing reliability; and (3) only the specified version 21.8.3.0.0 is listed as affected. The scope change means a successful exploit can impact additional co-located products, so the realistic blast radius depends on what else runs on the same host.

This is a moderate-severity, hard-to-exploit issue that is unlikely to be a top-tier emergency priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N, base 6.4) shows exploitation requires LOCAL access (AV:L) - the attacker must already have a logon on the infrastructure where Oracle Essbase executes - plus low privileges (PR:L) and must overcome high attack complexity (AC:H), which typically means race conditions, specific timing, or non-default state. These factors sharply limit opportunistic or remote mass exploitation. The one aggravating signal is the scope change (S:C): a successful attack can significantly impact additional products beyond Essbase itself, and confidentiality impact is High (full read of Essbase-accessible data) with partial integrity impact (I:L). No EPSS score, CISA KEV listing, or public POC was provided in the input, and there is no public exploit identified at time of analysis - all exploitation-probability signals are therefore absent rather than elevated. The 'Authentication Bypass' tag CONFLICTS with the description, which explicitly requires an authenticated low-privileged attacker with logon; treat that tag as suspect. Net: a legitimately scoped risk for environments running the affected Essbase build, but the local-access + high-complexity preconditions make it a patch-in-normal-cycle item rather than a drop-everything emergency, absent any exploitation evidence.

An attacker who already holds a low-privileged local account on the host running Oracle Essbase targets the Java Based Agent component, winning a difficult-to-trigger condition (AC:H) to break out of the intended privilege and scope boundary. Because the flaw causes a scope change, the successful attack lets them read all Essbase-accessible critical data and perform some unauthorized writes, potentially affecting adjacent products on the same infrastructure. No public exploit code is known at time of analysis, so this would require custom development against the specific condition.