Oracle Essbase 21.8.3.0.0 Has Critical Remote Code Execution Flaw

Oracle Essbase version 21.8.3.0.0 contains a critical security vulnerability that allows remote attackers to compromise the system. The National Vulnerability Database lists the flaw as CVE-2026-91658 with a severity score of 9.9. This rating indicates that the issue poses a significant risk to confidentiality, integrity, and availability within affected environments.

The vulnerability resides within the Security component of Oracle Essbase. According to the NVD record, the flaw is easily exploitable by a low-privileged attacker who has network access via HTTP. Successful exploitation results in the complete takeover of the Oracle Essbase instance. The CVSS vector confirms that no user interaction is required for the attack to succeed.

Context and Background

The National Vulnerability Database describes the issue as allowing a low-privileged attacker with network access via HTTP to compromise Oracle Essbase. The CVSS 3.1 Base Score of 9.9 reflects high impacts on confidentiality, integrity, and availability. The vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) details the technical conditions required for exploitation.

Although the vulnerability is located specifically within Oracle Essbase, the NVD notes that attacks may significantly impact additional products due to a scope change. This means that compromising the Essbase component could potentially affect other systems or services connected to or dependent on the vulnerable application. Such scope changes often elevate the risk profile of a single flaw.

Who Is Affected

Only Oracle Essbase version 21.8.3.0.0 is identified as affected by this specific vulnerability. Organizations running this exact version of the analytics and reporting software are exposed to the risk. The NVD record does not list other versions as affected, but users should verify their specific installation against this identifier.

The flaw requires an attacker to have network access via HTTP. This suggests that any system exposing this interface to untrusted networks is at risk. Low-privileged attackers can leverage this access to execute the exploit. The ease of exploitation combined with the high severity score makes this a priority issue for security teams managing Essbase deployments.

What should you do?

Security teams should immediately audit their environments to determine if Oracle Essbase version 21.8.3.0.0 is in use. If this version is present, organizations should restrict network access to the HTTP interface used by the application. Limiting access to trusted networks or specific IP addresses can reduce the attack surface until further guidance is available.

What to do and how to stay safe: Oracle

• Inventory all instances of Oracle Essbase to confirm if version 21.8.3.0.0 is deployed in your environment.
• Restrict network access to the HTTP ports used by Essbase to prevent unauthorized remote connections.
• Monitor logs for unusual HTTP traffic or authentication attempts from low-privileged accounts.
• Wait for official vendor advisories before applying any unverified patches or workarounds.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-91658?

The CVSS 3.1 Base Score is 9.9, which is rated as Critical severity.

Which version of Oracle Essbase is affected?

Only version 21.8.3.0.0 is listed as affected by this vulnerability.

Can an attacker exploit this flaw without user interaction?

Yes, the CVSS vector indicates no user interaction (UI:N) is required for exploitation.