CVE-2026-91663 in Essbase
Summary
by MITRE • 10/21/2026
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the security component of Oracle Essbase version 21.8.3.0.0, representing a critical flaw that allows for unauthorized access and system compromise. This specific iteration of the enterprise analytics platform is susceptible to an easily exploitable attack vector that does not require complex preconditions or user interaction. The primary mechanism for exploitation involves network-based protocols, specifically T3 and IIOP, which are commonly used in Java EE environments for remote method invocation and object communication. An attacker with low privileges who has established network connectivity to the affected system can leverage this flaw to bypass existing security controls. This indicates a fundamental failure in input validation or authentication logic within these protocol handlers, allowing malicious actors to execute arbitrary commands or access sensitive data structures that should be restricted.
The operational impact of this vulnerability is severe, characterized by a complete takeover of the Oracle Essbase environment. The CVSS 3.1 base score of 9.9 reflects high severity across all three core metrics: confidentiality, integrity, and availability. This means an attacker can not only read sensitive data but also modify system configurations or application logic, and potentially disrupt service operations entirely. Furthermore, the vulnerability exhibits a scope change behavior, meaning that while the technical flaw is located within Oracle Essbase, the consequences extend beyond this single product boundary. Successful exploitation may lead to lateral movement into adjacent systems or compromise of additional products integrated with Essbase, thereby expanding the blast radius of the incident and complicating containment efforts for security teams.
From a classification perspective, this vulnerability aligns with CWE-287, which denotes Improper Authentication, as well as potentially CWE-94, if code injection is involved in the exploitation chain via these protocols. In terms of adversary behavior mapping to MITRE ATT&CK, this scenario corresponds to Initial Access techniques involving Trusted Relationship or Exploitation for Client Execution, depending on whether the attacker leverages legitimate credentials obtained through other means or exploits a direct protocol flaw. The use of T3 and IIOP suggests that the attack surface includes legacy Java RMI interfaces which may not have been hardened against modern exploitation techniques targeting deserialization vulnerabilities or unvalidated input processing.
Mitigation strategies must prioritize immediate patching to version 21.8.3.0.0 with all available security updates, as this is the only definitive resolution for the underlying code flaw. In environments where patching cannot be applied immediately due to operational constraints, network segmentation should be enforced to restrict access to T3 and IIOP ports from untrusted networks or low-privilege user segments. Additionally, implementing strict firewall rules that limit these protocols to authorized administrative IPs can significantly reduce the attack surface. Security monitoring tools should be configured to detect anomalous traffic patterns associated with RMI protocol abuse, such as unusual deserialization attempts or unexpected connection sources on standard Java EE ports. Regular vulnerability assessments focusing on legacy enterprise application components are essential to identify similar misconfigurations before they are exploited in broader campaigns targeting Oracle infrastructure.