CVE-2026-91647

Analyzed Analyzed - Analysis Complete

Oracle Essbase Remote Code Execution Vulnerability

Publication date: 2026-10-20

Last updated on: 2026-10-23

Assigner: Oracle

Description

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-23

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-91647

EUVD

EUVD-2026-106834

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	essbase	21.8.3.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Essbase version 21.8.3.0.0 within the Security component. It allows an unauthenticated attacker with network access via TCP to potentially take over the system. The attack is difficult to exploit but can lead to full compromise of Oracle Essbase.

Detection Guidance

Detecting this vulnerability requires checking for Oracle Essbase versions and exposed TCP ports. Use commands like 'netstat -tuln | grep 1423' to check for Essbase default port 1423. Verify installed versions with 'opatch lsinventory' or check Oracle Essbase logs for unusual access patterns.

Impact Analysis

If exploited, this vulnerability could allow an attacker to take over your Oracle Essbase system. This could lead to unauthorized access, data breaches, loss of data integrity, and disruption of services, potentially affecting confidentiality, integrity, and availability of critical business data.

Compliance Impact

This vulnerability allows unauthenticated attackers to compromise Oracle Essbase, potentially leading to unauthorized access, data breaches, or system takeover. Such impacts could violate GDPR (data protection), HIPAA (health data security), and other regulations by exposing sensitive information or disrupting critical operations.

Mitigation Strategies

Apply Oracle's official patch immediately. Restrict network access to Essbase ports using firewalls. Disable unnecessary services and monitor for suspicious activity. Ensure authentication is enforced for all connections.

Hi! I’m here to help you understand CVE-2026-91647. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...