CVE-2026-91653

Vulnerability in Oracle Essbase (component: Essbase Web Platform)

Risk score: 53/100
CVSS: 8.5 v3.1
Exploit chance (30 days): 0.2%
Published: 20 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly imp…
Affected: Oracle Essbase
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Oracle Essbase: Amber, patch this week. A critical vulnerability in Oracle Essbase's security component allows unauthenticated attackers to compromise the system, potentially leading to a takeover. This is a remotely exploitable vulnerability without the need for login credentials.

The flaws

CVE-2026-91653: Vulnerability in Oracle Essbase (component: Essbase Web Platform) (CVSS 8.5 · EPSS 0%)
CVE-2026-91665: Vulnerability in Oracle Essbase (component: Security) (CVSS 9.8 · EPSS 0%)
CVE-2026-91638: Vulnerability in Oracle Essbase (component: Security) (CVSS 9.9 · EPSS 0%)
CVE-2026-91644: Vulnerability in Oracle Essbase (component: Security) (CVSS 9.3 · EPSS 0%)

The fix

Fix: Check the linked advisory for a fix, as none is provided in the record.

Who is exposed: {'product': 'Oracle Essbase', 'version': '21.8.3.0.0'}

Where it stands

No known exploitation

Connects to

Same weakness: Authentication bypass (CWE-287). 237 other warnings in 30 days
Same product: Earlier Oracle Essbase warnings. 32 in the last 90 days

Why it is Yellow

CVSS 8.5 high

References

https://www.oracle.com/security-alerts/cpuoct2026.html

Original description

Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as unauthorized update, insert or delete access to some of Oracle Essbase accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).

Last activity 20 Oct 2026. Patch Forecast updates every hour.