CVE-2026-91665 in Essbase
Summary
by MITRE • 10/21/2026
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Security component of Oracle Essbase version 21.8.3.0.0, representing a critical security flaw that fundamentally undermines the integrity and confidentiality of the application environment. This specific defect allows for unauthorized access by an unauthenticated attacker who possesses network connectivity to the target system via TCP protocols. The severity of this issue is underscored by its high exploitability rating, indicating that no complex conditions or user interaction are required to leverage the flaw against a vulnerable instance.
From a technical perspective, the vulnerability enables complete compromise of the Oracle Essbase service. An attacker can bypass authentication mechanisms entirely, gaining direct control over the application layer without valid credentials. This level of access typically stems from improper validation of input data or flawed logic in the security handling routines within the affected component. The absence of required authentication vectors means that any entity capable of reaching the server's network interface can initiate an attack sequence to escalate privileges and assume administrative control.
The operational impact of this vulnerability is severe, as reflected by a CVSS 3.1 Base Score of 9.8 out of 10. This score indicates high impacts across all three core pillars of information security: confidentiality, integrity, and availability. Successful exploitation allows an attacker to take over the Oracle Essbase instance, which can lead to unauthorized disclosure of sensitive business intelligence data, modification or destruction of critical analytical models and datasets, and disruption of services for legitimate users. In enterprise environments where Essbase is used for financial planning and analysis, such a breach could result in significant regulatory non-compliance and substantial reputational damage.
This vulnerability aligns with Common Weakness Enumeration categories related to authentication bypasses and improper access control mechanisms. Specifically, it relates to CWE-287 Improper Authentication and potentially CWE-306 Missing Authentication for Critical Function depending on the specific implementation details of the security component's handling of network requests. In terms of adversary tactics, this flaw facilitates initial access through unauthenticated remote exploitation, mapping closely to ATT&CK techniques associated with exploiting services that lack proper authentication checks or have known vulnerabilities in their authentication logic.
Mitigation strategies must prioritize immediate remediation due to the high severity and ease of exploitation. The primary recommendation is to apply the latest security patches provided by Oracle for version 21.8.3.0.0 as soon as they are available from official support channels. Until patching can be implemented, organizations should consider network-level mitigations such as restricting TCP access to the Essbase service ports using firewall rules or Access Control Lists (ACLs) to allow connections only from trusted IP addresses and subnets. Additionally, implementing a Web Application Firewall with specific rule sets designed to detect and block exploitation attempts for known authentication bypass vulnerabilities can provide an additional layer of defense in depth while permanent fixes are deployed.