Description
Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Essbase executes to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as unauthorized update, insert or delete access to some of Oracle Essbase accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N).
Published: 2026-10-20
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 03:15:00 +0000

Type Values Removed Values Added
Title Local Attack on Oracle Essbase Java Agent Enables Unauthorized Data Access

Wed, 28 Oct 2026 01:30:00 +0000

Type Values Removed Values Added
Title Local Privilege Exploit in Oracle Essbase Java Agent Allows Access to Confidential Data
Weaknesses CWE-200

Tue, 27 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 27 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Fri, 23 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
Title Local Privilege Exploit in Oracle Essbase Java Agent Allows Access to Confidential Data
Weaknesses CWE-200

Fri, 23 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation in Oracle Essbase Java Agent
Weaknesses CWE-269
CWE-284

Fri, 23 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Wed, 21 Oct 2026 12:00:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation in Oracle Essbase Java Agent
Weaknesses CWE-269
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Essbase executes to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as unauthorized update, insert or delete access to some of Oracle Essbase accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N).
First Time appeared Oracle
Oracle essbase
CPEs cpe:2.3:a:oracle:essbase:21.8.3.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle essbase
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N'}

Subscriptions

Oracle Essbase
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T21:29:26.191Z

Reserved: 2026-09-14T22:10:16.651Z

Link: CVE-2026-91662

cve-icon Vulnrichment

Updated: 2026-10-27T21:29:21.991Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:21:06.610

Modified: 2026-10-27T22:19:07.563

Link: CVE-2026-91662

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T03:00:15Z

Weaknesses