Oracle Essbase 21.8.3.0.0 Has Critical Remote Code Execution Flaw
A critical vulnerability in Oracle Essbase allows low-privileged network attackers to take over the system via T3 or IIOP protocols.
Key points
- CVE-2026-91663 carries a CVSS score of 9.9, rated as critical severity.
- The flaw affects Oracle Essbase version 21.8.3.0.0 specifically.
- Attackers need only low privileges and network access to exploit the issue.
Oracle Essbase version 21.8.3.0.0 contains a critical security vulnerability that allows remote attackers to compromise the system. The flaw, identified as CVE-2026-91663, enables a low-privileged attacker with network access to take full control of the application.
The vulnerability exists within the Security component of Oracle Essbase. According to the National Vulnerability Database, the issue is easily exploitable via the T3 or IIOP network protocols. Successful exploitation results in a complete takeover of the Oracle Essbase instance.
Severity and Scope
The National Vulnerability Database assigns a CVSS 3.1 Base Score of 9.9 to this vulnerability. This score reflects high impacts on confidentiality, integrity, and availability. The vector string indicates network exploitation with low complexity and no user interaction required.
While the vulnerability resides in Oracle Essbase, the scope change means attacks may significantly impact additional products. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) confirms the broad potential for damage across connected systems.
Affected Versions
Only Oracle Essbase version 21.8.3.0.0 is listed as affected by this specific vulnerability. Organizations running this exact version are at immediate risk from network-based attacks. Other versions of the software are not mentioned in the advisory as being vulnerable to this specific flaw.
What should you do?
Security teams should verify if they are running Oracle Essbase version 21.8.3.0.0. If this version is in use, restrict network access to the T3 and IIOP ports to trusted sources only. Monitor logs for unusual activity indicative of remote takeover attempts.
What to do and how to stay safe: Oracle
- Inventory all systems running Oracle Essbase to identify version 21.8.3.0.0
- Restrict network access to T3 and IIOP ports to reduce exposure
- Monitor system logs for signs of unauthorized remote access attempts
- Wait for vendor guidance before applying unverified patches or workarounds
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-91663?
The CVSS 3.1 Base Score is 9.9, which is rated as critical severity.
Which Oracle Essbase version is affected?
Only version 21.8.3.0.0 is listed as affected by this vulnerability.
How can an attacker exploit this flaw?
Attackers can exploit the vulnerability via network access using T3 or IIOP protocols.
