Oracle Essbase 21.8.3.0.0 Has Critical Unauthenticated Flaw CVE-2026-91644
A critical vulnerability in Oracle Essbase allows remote attackers to access data without authentication, earning a CVSS score of 9.3.
Key points
- The flaw affects Oracle Essbase version 21.8.3.0.0 and is rated critical.
- Attackers need only network access via HTTP to exploit the security weakness.
- Successful exploitation allows unauthorized access to critical data and modifications.
Oracle Essbase version 21.8.3.0.0 contains a critical security vulnerability that allows unauthenticated attackers to compromise the system. The flaw is tracked as CVE-2026-91644 and carries a CVSS 3.1 Base Score of 9.3, indicating a severe risk to confidentiality and integrity.
The vulnerability resides in the security component of the Oracle Essbase product. According to the National Vulnerability Database record, the issue is easily exploitable by an attacker with network access via HTTP. No user interaction or authentication credentials are required to trigger the exploit, making it accessible to remote adversaries.
Context and Background
The security weakness permits an attacker to gain unauthorized access to critical data within the Oracle Essbase environment. Successful exploitation can also result in the ability to update, insert, or delete accessible data. The CVSS vector indicates high impact on confidentiality and low impact on integrity, with no impact on availability.
Although the vulnerability is located within Oracle Essbase, the scope change metric suggests that attacks may significantly impact additional products. This means the consequences of a successful breach could extend beyond the immediate application to other connected systems or data repositories.
Who Is Affected
The specific supported version affected by this vulnerability is Oracle Essbase 21.8.3.0.0. Organizations running this exact version are exposed to the risk of unauthenticated remote attacks. The ease of exploitation combined with the lack of required user interaction heightens the danger for systems exposed to the internet or internal networks.
The NVD record highlights that the vulnerability allows network access via HTTP to compromise the system. This vector is common for web-facing applications, meaning any instance of this version accessible over a network is potentially vulnerable. There is no mention of other versions being affected in the provided material.
What should you do?
No fix has been confirmed yet for this vulnerability. Administrators should verify if they are running Oracle Essbase version 21.8.3.0.0. If this version is in use, immediate steps should be taken to restrict network access to the application. Monitoring for unusual HTTP traffic or unauthorized data access attempts is also recommended.
What to do and how to stay safe: Oracle
- Verify if your environment runs Oracle Essbase version 21.8.3.0.0.
- Restrict network access to the application to limit exposure to unauthenticated requests.
- Monitor logs for unauthorized HTTP requests or attempts to access critical data.
- Await official updates from Oracle regarding patches or mitigation strategies.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-91644?
The CVSS 3.1 Base Score is 9.3, which is classified as critical.
Which Oracle Essbase version is affected?
The supported version affected is 21.8.3.0.0.
Is authentication required to exploit this vulnerability?
No, the vulnerability allows an unauthenticated attacker to compromise the system.
