CVE-2026-91664

Undergoing Analysis Undergoing Analysis - In Progress

Denial of Service in Oracle Essbase

Publication date: 2026-10-20

Last updated on: 2026-10-23

Assigner: Oracle

Description

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Essbase. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-23

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-91664

EUVD

EUVD-2026-106851

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	essbase	21.8.3.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This is a denial-of-service (DoS) vulnerability in Oracle Essbase version 21.8.3.0.0. It allows an unauthenticated attacker with network access to crash the system repeatedly or cause a complete outage by exploiting a flaw in the Security component.

Detection Guidance

Detecting this vulnerability requires checking for Oracle Essbase versions and network exposure. Verify if Oracle Essbase 21.8.3.0.0 is running on your system. Use commands like 'ps -ef | grep essbase' or 'netstat -tulnp | grep 1423' to check for active processes and listening ports. Ensure the system is not exposed to unauthenticated TCP access.

Impact Analysis

If exploited, this vulnerability could disrupt Oracle Essbase services, leading to downtime and loss of availability for critical applications relying on this software. It does not allow data theft or modification, only system unavailability.

Compliance Impact

This vulnerability primarily impacts availability. Compliance with GDPR or HIPAA could be affected if the outage disrupts access to personal or health data, potentially violating availability requirements. However, no direct data exposure is involved.

Mitigation Strategies

Apply the latest security patches from Oracle for Essbase version 21.8.3.0.0. Restrict network access to Oracle Essbase via TCP to trusted sources only. Monitor network traffic for unusual activity targeting Essbase ports.

Hi! I’m here to help you understand CVE-2026-91664. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...