CVE-2026-91563: Oracle OLAP Privilege Escalation Vulnerability

CVE-2026-91563 Overview

CVE-2026-91563 is a vulnerability in the Oracle OLAP (Online Analytical Processing) component of Oracle Database Server. The flaw allows a low-privileged attacker holding the DBMS_AW privilege to compromise Oracle OLAP over Oracle Net. Successful exploitation results in full takeover of the Oracle OLAP component, impacting confidentiality, integrity, and availability. Oracle addressed the issue in the October 2026 Critical Patch Update.

Critical Impact
An authenticated attacker with network access and the DBMS_AW privilege can take over the Oracle OLAP component, enabling unauthorized access to analytical data and database operations.

Affected Products

Oracle Database Server 19.3 through 19.32
Oracle Database Server 21.3 through 21.23
Oracle Database Server 23.4.0 through 23.26.3

Discovery Timeline

2026-10-20 - CVE-2026-91563 published to NVD
2026-10-21 - Last updated in NVD database
October 2026 - Oracle releases security patch via Critical Patch Update

Technical Details for CVE-2026-91563

Vulnerability Analysis

The vulnerability resides in the Oracle OLAP component of Oracle Database Server. Oracle OLAP provides multidimensional analytical capabilities inside the database engine. Exploitation requires an authenticated session with the DBMS_AW privilege, which grants access to the Analytic Workspace management interfaces.

An attacker with that privilege can issue crafted operations through Oracle Net to compromise the OLAP component. The attack vector is network-based, requires low complexity, and does not involve user interaction. The confidentiality, integrity, and availability impacts are each rated high, reflecting complete takeover of the OLAP component. The vulnerability remains within the same security scope.

Root Cause

Oracle has not published the underlying code defect. Based on the privilege precondition and the takeover outcome, the issue stems from insufficient validation of input or operations exposed through DBMS_AW procedures that execute with elevated context inside the OLAP component. Oracle discloses limited root-cause detail for Critical Patch Update entries.

Attack Vector

Exploitation proceeds over Oracle Net from any network-reachable client. The attacker must authenticate to the database and must hold the DBMS_AW privilege. Once connected, the attacker invokes the vulnerable OLAP interface to escalate control over the OLAP component. No user interaction and no local access are required.

No public proof-of-concept code is available for CVE-2026-91563. See the Oracle Critical Patch Update October 2026 for vendor technical references.

Detection Methods for CVE-2026-91563

Indicators of Compromise

Unexpected sessions from accounts holding the DBMS_AW privilege, particularly from unusual source hosts or outside maintenance windows.
Anomalous invocations of OLAP Analytic Workspace procedures tied to the DBMS_AW package.
Creation, modification, or deletion of analytic workspaces by accounts that do not normally perform OLAP operations.

Detection Strategies

Enable Oracle Unified Auditing for the DBMS_AW package and OLAP-related objects to capture privileged use.
Correlate database audit records with network telemetry to identify Oracle Net sessions originating from unauthorized subnets.
Baseline normal OLAP usage patterns and alert on deviations such as new callers of DBMS_AW procedures or privilege grants to new principals.

Monitoring Recommendations

Review all current grantees of the DBMS_AW privilege and revoke access for accounts that do not require OLAP functionality.
Monitor Oracle Listener logs for new client connections targeting database services that host OLAP workloads.
Forward database audit trails and listener logs to a centralized analytics platform for retention and correlation.

How to Mitigate CVE-2026-91563

Immediate Actions Required

Apply the October 2026 Oracle Critical Patch Update to all affected Oracle Database Server instances.
Inventory databases running versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3 and prioritize those exposing OLAP functionality.
Audit and reduce the set of accounts holding the DBMS_AW privilege to the minimum required.

Patch Information

Oracle addressed CVE-2026-91563 in the October 2026 Critical Patch Update. Patch details, download links, and version-specific guidance are available in the Oracle Critical Patch Update October 2026 advisory. Apply the Release Update that matches each database version in the affected ranges.

Workarounds

Revoke the DBMS_AW privilege from accounts that do not require Oracle OLAP functionality until patching is complete.
Restrict Oracle Net access to the database using network ACLs, Oracle Connection Manager, or Valid Node Checking so that only trusted hosts can reach the listener.
Enforce strong authentication and credential rotation for all accounts with database access to limit opportunities for privilege abuse.

bash

# Review and revoke DBMS_AW privilege from non-essential accounts
SELECT grantee, privilege FROM dba_sys_privs WHERE privilege = 'EXECUTE' AND grantee IN (
  SELECT grantee FROM dba_tab_privs WHERE table_name = 'DBMS_AW'
);

REVOKE EXECUTE ON SYS.DBMS_AW FROM <username>;