CVE-2026-91656

Summary

A vulnerability in Oracle Essbase's Federated Partitions component allows a low-privileged attacker with network access via HTTP to achieve unauthorized access to critical data, modify some data, and cause a partial denial of service. The flaw enables scope escalation beyond Essbase itself, amplifying impact.

Exploitability

Easily exploitable by a low-privileged attacker over the network without user interaction, requiring only HTTP access.

Blast radius

Successful exploitation could lead to full compromise of Essbase data confidentiality, partial integrity loss (unauthorized updates/inserts/deletes), and partial service disruption, with potential impact on other interconnected systems due to scope change.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Oracle Essbase version 21.8.4.0.0 or later, as this is the first fixed version following 21.8.3.0.0 per standard Oracle patching cycles (note: the CVE description does not explicitly name a fixed version; however, Oracle typically releases critical patch updates quarterly, and 21.8.4.0.0 is the next minor release after 21.8.3.0.0 — verify via Oracle Critical Patch Update Advisory for April 2026). If immediate patching is not possible, disable Federated Partitions functionality and restrict HTTP access to Essbase endpoints to trusted networks only.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.