CVE-2026-91650 Oracle CVE debrief

Who should care

Defenders responsible for Oracle Essbase deployments, particularly those with network access via HTTP, should assess exposure and prioritize verification and potential remediation.

Why it matters

Defenders should prioritize verifying exposure in their Oracle Essbase 21.8.3.0.0 deployments and assess the need for compensating controls due to a difficult-to-exploit vulnerability allowing unauthorized read access to a subset of Oracle Essbase accessible data.

• Potential unauthorized read access to a subset of Oracle Essbase accessible data
• Need for verification of exposure in Oracle Essbase 21.8.3.0.0 deployments
• Potential need for compensating controls for unauthorized read access

Technical summary

Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. The vulnerability has a CVSS score of 3.7 and a CVSS vector of (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Defenders should prioritize verifying exposure in their Oracle Essbase 21.8.3.0.0 deployments and assess the need for compensating controls.

Defensive priority

Defenders should prioritize verifying exposure in their Oracle Essbase 21.8.3.0.0 deployments and assess the need for compensating controls.

Recommended defensive actions

• Verify Oracle Essbase version and assess exposure
• Review network access controls to HTTP
• Implement compensating controls for unauthorized read access
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Oracle Essbase 21.8.3.0.0. Vendor advisory from Oracle is available. The vulnerability has a CVSS score of 3.7 and a CVSS vector of (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). The supported version that is affected is 21.8.3.0.0. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.