CVE-2026-91655

Summary

A vulnerability in Oracle Essbase's Security component allows a low-privileged attacker with network access via HTTP to achieve unauthorized access to critical data, modify some data, and cause a partial denial of service due to improper input validation or access controls.

Exploitability

Easily exploitable by a low-privileged attacker over the network without user interaction.

Blast radius

Successful exploitation could lead to full read access to all Essbase data, partial data modification, and service disruption, potentially affecting other interconnected systems due to scope change.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade Oracle Essbase to the fixed version 21.8.3.0.0 patch level or later, as specified in the vendor advisory (note: the description does not specify a patched version beyond the affected one; if no fixed version is published, apply Oracle Critical Patch Update guidance and restrict HTTP access to Essbase endpoints until patched).

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.