Description
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote System Compromise
Action: Immediate Patch
AI Analysis

Impact

The vulnerability in Oracle Essbase allows an unauthenticated attacker with network access to exploit a weak authentication mechanism (CWE-287) and a missing authentication check (CWE-306) in the Security component. Successful exploitation can lead to a full takeover of the Essbase instance, resulting in total loss of confidentiality, integrity, and availability for the affected data. The CVSS score of 9.8 underscores the high severity of this issue.

Affected Systems

Oracle Essbase version 21.8.3.0.0 is affected. The product is used by Oracle Corporation for enterprise analytics, and any deployment of this specific build is at risk.

Risk and Exploitability

The vulnerability is readily exploitable over the network via TCP without authentication or user interaction. The EPSS score of < 1% indicates a low probability of exploitation currently, and the CVSS base score of 9.8 highlights severe confidentiality, integrity, and availability impacts, implying that any successful attack would result in full system compromise. The issue is not listed in CISA's KEV catalog.

Generated by OpenCVE AI on October 22, 2026 at 05:31 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle Essbase patch for version 21.8.3.0.0 as released in the official Oracle CPU October 2026 advisory, which fixes the authentication and verification weaknesses (CWE-287, CWE-306).
  • Limit network exposure by configuring firewalls or access control lists to permit TCP traffic to the Essbase servers only from trusted administrative hosts.
  • Enable and regularly review logging and monitoring for unusual or unauthenticated connection attempts to the Essbase service.

Generated by OpenCVE AI on October 22, 2026 at 05:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Access Vulnerability in Oracle Essbase Leading to Full System Compromise
Weaknesses CWE-284

Wed, 21 Oct 2026 12:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Access Vulnerability in Oracle Essbase Leading to Full System Compromise
Weaknesses CWE-284

Wed, 21 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287
CWE-306
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle essbase
CPEs cpe:2.3:a:oracle:essbase:21.8.3.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle essbase
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Essbase
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T23:04:38.772Z

Reserved: 2026-09-14T22:10:16.651Z

Link: CVE-2026-91665

cve-icon Vulnrichment

Updated: 2026-10-21T10:52:05.260Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:21:06.960

Modified: 2026-10-22T23:20:33.240

Link: CVE-2026-91665

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T05:45:14Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function