Oracle Essbase 21.8.3.0.0 Has Critical Vulnerability Allowing Takeover

Oracle Essbase version 21.8.3.0.0 contains a critical security vulnerability that allows attackers to take over the application. The National Vulnerability Database lists the flaw as CVE-2026-91637 with a CVSS score of 9.9.

The vulnerability resides in the Security component of Oracle Essbase. It is easily exploitable and allows a low-privileged attacker with network access via HTTP to compromise the system. Successful exploitation results in full takeover of Oracle Essbase.

Technical Details of the Flaw

The National Vulnerability Database rates the severity of CVE-2026-91637 as Critical. The CVSS 3.1 Base Score is 9.9, indicating high impacts on confidentiality, integrity, and availability. The vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

The attack vector is network-based, meaning no physical access is required. The attack complexity is low, and user interaction is not required. Privileges required are low, meaning the attacker does not need administrative rights to initiate the exploit.

Scope and Impact

While the vulnerability is located in Oracle Essbase, attacks may significantly impact additional products. The National Vulnerability Database notes that the scope changes during exploitation. This suggests that compromising Essbase could lead to broader system compromise.

The flaw allows for complete takeover of the affected Oracle Essbase instance. This includes loss of confidentiality, integrity, and availability. The ease of exploitation makes this a high-priority issue for organizations using this specific version.

What should you do?

Organizations using Oracle Essbase 21.8.3.0.0 should verify their exposure immediately. Administrators should monitor for vendor updates closely. Restricting network access to the HTTP service can reduce the attack surface.

What to do and how to stay safe: Oracle Essbase

• Inventory all systems running Oracle Essbase version 21.8.3.0.0.
• Restrict network access to the HTTP service used by Essbase.
• Monitor for official vendor patches or security advisories.
• Review logs for unusual HTTP traffic patterns.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-91637?

The CVSS 3.1 Base Score is 9.9, which is rated as Critical.

Which version of Oracle Essbase is affected?

Only version 21.8.3.0.0 is listed as affected in the NVD record.

Can an attacker exploit this flaw remotely?

Yes, the vulnerability allows remote exploitation via HTTP with low privileges.