CVE-2026-91664 in Essbase
Summary
by MITRE • 10/21/2026
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Essbase. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the security component of Oracle Essbase, specifically affecting version 21.8.3.0.0 and potentially other supported releases in that lineage. This flaw represents a critical weakness in how the application handles incoming network requests before authentication is fully established or validated. The core technical issue involves an improper validation mechanism for specific input parameters sent over TCP connections. When an unauthenticated attacker interacts with this component, they can trigger a state within the software where resource management fails to recover gracefully from malformed or excessively large inputs. This failure leads directly to memory exhaustion, thread blocking, or infinite loops within the Essbase service processes, resulting in a complete denial of service condition. The application becomes unresponsive and may require manual intervention or restart by system administrators to restore functionality, effectively halting all analytical operations dependent on this instance.
From an operational perspective, the impact is severe due to the high availability score assigned by the Common Vulnerability Scoring System version 3.1. With a base score of 7.5, classified as High severity, the vulnerability primarily impacts system availability rather than confidentiality or integrity. This means that while attackers cannot necessarily steal data or modify existing information through this specific vector, they can effectively shut down critical business intelligence and analytics platforms. For organizations relying on Oracle Essbase for financial planning, sales forecasting, or resource management, such a disruption can lead to significant operational downtime, missed deadlines, and potential revenue loss. The ease of exploitation is heightened by the fact that no prior authentication is required, allowing any remote actor with network connectivity to attempt this attack without needing valid credentials.
The technical classification aligns with CWE-400, which describes uncontrolled resource consumption leading to denial of service conditions. Furthermore, in terms of adversary behavior mapping under the MITRE ATT&CK framework, this vulnerability facilitates actions consistent with Impact categories such as Service Stop or Resource Hijacking. Attackers can leverage automated tools to send repeated requests designed to exhaust system resources, creating a persistent disruption that is difficult to mitigate without patching the underlying software defect. The network access vector indicates that the attack surface includes any host able to reach the Essbase server over TCP/IP networks, including public internet-facing deployments if not properly segmented or firewalled.
Mitigation strategies must prioritize immediate remediation through official Oracle security patches. Organizations should apply the latest critical patch updates provided by Oracle for their specific version of Essbase to address this flaw in the security component logic. In environments where patching cannot be implemented immediately due to maintenance windows, temporary mitigations include restricting network access to the affected service ports using firewall rules or intrusion prevention systems that can detect and block anomalous traffic patterns associated with resource exhaustion attacks. Additionally, implementing rate limiting on incoming connections can help reduce the effectiveness of automated denial-of-service attempts by throttling requests from single sources until they are verified as legitimate users. Regular monitoring for unusual spikes in CPU or memory usage related to Essbase processes should also be established to detect potential exploitation attempts early and trigger incident response procedures before total service failure occurs.