Description
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Essbase. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (Application Unavailability)
Action: Patch promptly
AI Analysis

Impact

A flaw in Oracle Essbase 21.8.3.0.0 permits an unauthenticated attacker with network access via TCP to trigger a hang or crash, resulting in a complete denial of service. The CVSS 3.1 score of 7.5 highlights a high availability impact while confidentiality and integrity are unaffected. The weakness aligns with resource exhaustion or improper input handling, which maps to CWE‑400.

Affected Systems

Oracle Essbase 21.8.3.0.0 from Oracle Corporation, specifically the Security component of the product. No other versions are listed as affected.

Risk and Exploitability

The CVSS base score indicates high severity, and the absence of an EPSS score means exploitation probability data is unavailable at this time. Because the vulnerability can be triggered by unauthenticated traffic on the TCP port used by Essbase, the attack vector is network. The flaw is addressed in Oracle's October 2026 security patch but is not listed in the CISA KEV catalog. Successful exploitation allows an attacker to repeatedly hang or crash Essbase, causing prolonged outages until the service is restarted or patched.

Generated by OpenCVE AI on October 21, 2026 at 11:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle security patch for Essbase 21.8.3.0.0 as soon as it becomes available.
  • Restrict inbound TCP traffic to the Essbase server to trusted hosts or networks using firewall rules or network segmentation.
  • If a patch is delayed, reduce risk by configuring the application to limit request sizes or enable resource throttling if supported, or isolate Essbase to a protected network segment.
  • Monitor logs for signs of repeated hang or crash activity and investigate anomalies promptly.

Generated by OpenCVE AI on October 21, 2026 at 11:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 12:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote DoS via TCP in Oracle Essbase 21.8.3.0.0
Weaknesses CWE-400

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Essbase. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle essbase
CPEs cpe:2.3:a:oracle:essbase:21.8.3.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle essbase
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Essbase
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T18:50:20.995Z

Reserved: 2026-09-14T22:10:16.651Z

Link: CVE-2026-91664

cve-icon Vulnrichment

Updated: 2026-10-22T18:40:41.456Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:21:06.847

Modified: 2026-10-23T17:15:47.933

Link: CVE-2026-91664

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T14:00:07Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption