CVE-2026-91660 Oracle CVE debrief

Who should care

Defenders responsible for Oracle Essbase instances, especially those with low-privileged network access, should assess potential exposure and prioritize verifying and mitigating this vulnerability.

Why it matters

Defenders should prioritize verifying exposure and assessing potential impact on Oracle Essbase instances, especially those with low-privileged network access, due to a potential partial denial of service (partial DOS) vulnerability.

• Potential partial denial of service (partial DOS) of Oracle Essbase
• Verification of Oracle Essbase version and exposure to low-privileged network access
• Assessment of network access controls to limit low-privileged access to Oracle Essbase
• Monitoring of Oracle Essbase logs for potential denial of service attempts

Technical summary

The vulnerability in Oracle Essbase (component: Security) allows a low-privileged attacker with network access via HTTP to compromise Oracle Essbase, potentially causing a partial denial of service (partial DOS). The CVSS 3.1 Base Score is 4.3 (Availability impacts). The supported version that is affected is 21.8.3.0.0. The vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. The vulnerability has been assessed as having a medium severity impact on availability.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact on Oracle Essbase instances, especially those with low-privileged network access.

Recommended defensive actions

• Verify Oracle Essbase version 21.8.3.0.0 is in use and assess potential exposure
• Implement network access controls to limit low-privileged access to Oracle Essbase
• Monitor Oracle Essbase logs for potential denial of service attempts
• Review and apply Oracle's security patches and updates
• Perform vulnerability scanning to identify exposed instances
• Conduct regular security audits to detect potential vulnerabilities
• Review incident response plans to ensure preparedness for potential attacks

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected version, and potential impact. However, additional information on exploitation or victim organizations is not available. The vulnerability has a CVSS 3.1 Base Score of 4.3 (Availability impacts). The supported version that is affected is 21.8.3.0.0. The vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle Essbase.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.