CVE-2026-91635

Analyzed Analyzed - Analysis Complete

Oracle Essbase Remote Code Execution Vulnerability

Publication date: 2026-10-20

Last updated on: 2026-10-23

Assigner: Oracle

Description

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-23

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-91635

EUVD

EUVD-2026-106822

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	essbase	21.8.3.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Essbase version 21.8.3.0.0 affecting the Security component. It allows an unauthenticated attacker with network access via T3 or IIOP protocols to compromise the system. Successful exploitation could lead to complete takeover of Oracle Essbase.

Detection Guidance

Detection requires checking for Oracle Essbase instances exposed to T3 or IIOP protocols. Verify if the affected version 21.8.3.0.0 is running. Use network scanning tools to identify open ports 1423 (T3) or 1521 (IIOP) on systems with Oracle Essbase. Inspect logs for unusual authentication attempts or unauthorized access patterns.

Impact Analysis

An attacker could gain full control over your Oracle Essbase system, potentially accessing, modifying, or deleting sensitive data. This could disrupt business operations and lead to data breaches or unauthorized system changes.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Apply the latest security patches from Oracle for Oracle Essbase version 21.8.3.0.0. Restrict network access to T3 and IIOP ports. Monitor for unusual activity or unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-91635. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...