SB2026111018 - Multiple vulnerabilities in Oracle Essbase

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026111018

SB2026111018 - Multiple vulnerabilities in Oracle Essbase

Published: November 10, 2026

Security Bulletin ID SB2026111018
CSH Severity
High
Patch available
YES
Number of vulnerabilities 38
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 32% Medium 53% Low 16%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 38 vulnerabilities.


1) Improper input validation (CVE-ID: CVE-2026-91651)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Essbase Web Platform component in Oracle Essbase. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-54428)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the HTTP/2 HPACK decoder when processing compressed header blocks before the HTTP/2 SETTINGS acknowledgement. A remote attacker can send oversized compressed header blocks to cause a denial of service.

The issue can lead to memory exhaustion before the configured header list size limit is applied.


3) Improper input validation (CVE-ID: CVE-2026-91661)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.


4) Improper input validation (CVE-ID: CVE-2026-91639)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.


5) Improper input validation (CVE-ID: CVE-2026-91636)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.


6) Improper input validation (CVE-ID: CVE-2026-91632)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.


7) Improper input validation (CVE-ID: CVE-2026-91659)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Build component in Oracle Essbase. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.


8) Improper input validation (CVE-ID: CVE-2026-91647)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


9) Improper input validation (CVE-ID: CVE-2026-91635)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


10) Improper input validation (CVE-ID: CVE-2026-91653)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Essbase Web Platform component in Oracle Essbase. A remote authenticated user can exploit this vulnerability to read and manipulate data.


11) Improper input validation (CVE-ID: CVE-2026-91664)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.


12) Improper input validation (CVE-ID: CVE-2026-91655)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read, manipulate or delete data.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote authenticated user can exploit this vulnerability to read, manipulate or delete data.


13) Improper input validation (CVE-ID: CVE-2026-91656)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read, manipulate or delete data.

The vulnerability exists due to improper input validation within the Federated Partitions component in Oracle Essbase. A remote authenticated user can exploit this vulnerability to read, manipulate or delete data.


14) Improper input validation (CVE-ID: CVE-2026-91644)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.


15) Improper input validation (CVE-ID: CVE-2026-91665)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


16) Improper input validation (CVE-ID: CVE-2026-91663)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


17) Improper input validation (CVE-ID: CVE-2026-91658)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


18) Improper input validation (CVE-ID: CVE-2026-91638)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


19) Improper input validation (CVE-ID: CVE-2026-91637)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


20) Improper input validation (CVE-ID: CVE-2026-91643)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Java Based Agent component in Oracle Essbase. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.


21) Improper input validation (CVE-ID: CVE-2026-91660)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to perform service disruption.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote authenticated user can exploit this vulnerability to perform service disruption.


22) Improper input validation (CVE-ID: CVE-2026-91657)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.


23) Improper input validation (CVE-ID: CVE-2026-91652)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.


24) Improper input validation (CVE-ID: CVE-2026-91641)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.


25) Improper input validation (CVE-ID: CVE-2026-91640)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.


26) Improper input validation (CVE-ID: CVE-2026-91631)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.


27) Improper input validation (CVE-ID: CVE-2026-91648)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Java Based Agent component in Oracle Essbase. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.


28) Improper input validation (CVE-ID: CVE-2026-91634)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.


29) Improper input validation (CVE-ID: CVE-2026-91645)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.


30) Improper input validation (CVE-ID: CVE-2026-91650)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Java Based Agent component in Oracle Essbase. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.


31) Uncontrolled Recursion (CVE-ID: CVE-2025-48924)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop. A remote attacker can trigger uncontrolled recursion and perform a denial of service (DoS) attack.


32) Improper input validation (CVE-ID: CVE-2026-91646)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.


33) Improper input validation (CVE-ID: CVE-2026-91633)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A local privileged user can exploit this vulnerability to gain access to sensitive information.


34) Improper input validation (CVE-ID: CVE-2026-91649)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Java Based Agent component in Oracle Essbase. A local privileged user can exploit this vulnerability to gain access to sensitive information.


35) Improper input validation (CVE-ID: CVE-2026-91654)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote authenticated user can exploit this vulnerability to read and manipulate data.


36) Improper input validation (CVE-ID: CVE-2026-91662)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Java Based Agent component in Oracle Essbase. A local authenticated user can exploit this vulnerability to read and manipulate data.


37) Improper input validation (CVE-ID: CVE-2026-91630)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote privileged user can exploit this vulnerability to gain access to sensitive information.


38) Improper input validation (CVE-ID: CVE-2026-91642)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Security component in Oracle Essbase. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.


Remediation

Install update from vendor's website.

References