Oracle Essbase HTTP Vulnerability Enables Low-Privilege Data Modification and Deletion

Oracle Essbase contains a critical security vulnerability that allows attackers with low privileges to compromise the system. The flaw, identified as CVE-2026-91655, is in the Security component of the software. According to the National Vulnerability Database, this issue is easily exploitable over a network using HTTP. It grants unauthorized access to critical data and permits modification or deletion of information.

Root cause

The vulnerability is located in the Security component of Oracle Essbase. The National Vulnerability Database describes it as an easily exploitable flaw that allows a low-privileged attacker with network access to compromise the system. The issue enables unauthorized access to critical data or complete access to all Oracle Essbase accessible data. It also allows for unauthorized updates, inserts, or deletions of some accessible data.

Attack path

An attacker needs network access to the affected Oracle Essbase instance to exploit this flaw. The attack vector is network-based, and the complexity is low. The attacker requires only low privileges and no user interaction. Successful exploitation results in high confidentiality impact, allowing full data access. It also leads to low integrity and availability impacts, including partial denial of service.

Affected versions

The National Vulnerability Database specifies that the supported version affected by this vulnerability is Oracle Essbase 21.8.3.0.0. Organizations running this specific version are exposed to the risk. The record does not list other versions as affected. Users of this release should verify their environment against this specific version number to determine exposure.

Mitigation

• Verify if Oracle Essbase version 21.8.3.0.0 is deployed in your environment.
• Restrict network access to the HTTP service used by Essbase to reduce exposure.
• Monitor logs for unauthorized data access or modification attempts from low-privilege accounts.
• Ensure that authentication mechanisms are strictly enforced for all network connections to the component.

Signals worth monitoring

Teams should watch for unusual HTTP requests to Essbase endpoints from accounts with low privileges. Look for sudden spikes in data modification or deletion events that do not match normal business patterns. Check for access attempts to critical data stores that typically require higher clearance. Alert on failed authentication attempts followed by successful low-privilege actions. Review system logs for signs of partial service disruption or unexpected performance degradation.

What to do and how to stay safe: Oracle

• Audit network configurations to ensure only authorized systems can reach the Essbase HTTP service.
• Review access controls to confirm that low-privileged accounts cannot perform data modifications.
• Monitor application logs for anomalous HTTP traffic patterns that may indicate exploitation attempts.
• Prepare incident response plans that include steps for isolating affected Essbase instances if compromise is suspected.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-91655?

The National Vulnerability Database assigns a CVSS 3.1 Base Score of 9.1, which is rated as Critical.

Which version of Oracle Essbase is affected?

Only Oracle Essbase version 21.8.3.0.0 is listed as affected in the vulnerability record.

Can this vulnerability be exploited remotely?

Yes, the vulnerability allows a network-based attacker to exploit the flaw via HTTP without user interaction.