Remote Code Execution Vulnerability in Oracle Essbase 21.8.3.0.0
CVE-2026-91659

7.7HIGH

Key Information:

Vendor

Oracle
Status
Oracle Essbase
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91659?

A vulnerability exists in Oracle Essbase, specifically in the Build component affecting version 21.8.3.0.0. This issue is easily exploitable by a low privileged attacker with network access via HTTP. Successful exploitation may allow unauthorized access to critical data, which could significantly impact other connected products. Once exploited, the attacker could obtain complete access to all data accessible within Oracle Essbase, thereby jeopardizing the confidentiality of sensitive information.

Affected Version(s)

Oracle Essbase 21.8.3.0.0

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.