Oracle Essbase 21.8.3.0.0 Has Critical Remote Code Execution Flaw

Oracle Essbase version 21.8.3.0.0 contains a critical security vulnerability that allows unauthenticated attackers to take over the system remotely. The National Vulnerability Database lists this flaw as CVE-2026-91665, assigning it a CVSS 3.1 Base Score of 9.8, which indicates severe risk to organizations using this specific release.

The vulnerability resides in the Security component of Oracle Essbase and is easily exploitable over a TCP network connection. According to the NVD record, an attacker does not need authentication or user interaction to exploit this weakness. Successful attacks result in complete takeover of the Oracle Essbase instance, compromising confidentiality, integrity, and availability with high impact across all three metrics.

Technical Details of the Vulnerability

The CVSS vector for CVE-2026-91665 is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This vector indicates that the attack vector is network-based, and the attack complexity is low. The privilege level required is none, meaning no prior authentication is necessary. User interaction is also not required, making this a high-risk target for automated scanning and exploitation tools.

The weakness affects the supported version 21.8.3.0.0 of Oracle Essbase. The National Vulnerability Database describes the issue as a vulnerability in the Security component that allows an unauthenticated attacker with network access via TCP to compromise the software. The high base score reflects the ease of exploitation and the severity of the potential outcome.

Affected Systems and Scope

Only Oracle Essbase version 21.8.3.0.0 is listed as affected by this vulnerability. Organizations running this specific version are exposed to remote takeover risks if the system is accessible over a network. The flaw does not require the attacker to have any credentials or to interact with a user interface.

The impact includes high scores for confidentiality, integrity, and availability. This means that an attacker could potentially read sensitive data, modify system files or configurations, and disrupt service availability. The ease of exploitation combined with the high impact makes this a critical priority for security teams managing Oracle Essbase infrastructure.

What should you do?

Security teams should immediately verify if their Oracle Essbase installations are running version 21.8.3.0.0. If this version is in use, network access controls should be reviewed to limit exposure to untrusted networks. Monitoring for unusual TCP traffic to Essbase ports can help detect potential exploitation attempts.

What to do and how to stay safe: Oracle

• Inventory all Oracle Essbase instances to identify any running version 21.8.3.0.0.
• Restrict network access to Essbase servers using firewalls to block unauthorized TCP connections.
• Monitor logs for unauthenticated access attempts or unusual activity on Essbase ports.
• Prepare to apply vendor updates once Oracle releases a patch for CVE-2026-91665.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-91665?

The CVSS 3.1 Base Score for CVE-2026-91665 is 9.8, which is rated as critical.

Which version of Oracle Essbase is affected?

Only Oracle Essbase version 21.8.3.0.0 is affected by this vulnerability.

Do attackers need authentication to exploit this flaw?

No, the vulnerability allows unauthenticated attackers to exploit the system via TCP network access.