Exploitable Security Flaw in Oracle Essbase 21.8.3.0.0
CVE-2026-91663

9.9CRITICAL

Key Information:

Vendor

Oracle
Status
Oracle Essbase
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91663?

A security vulnerability has been identified in Oracle Essbase, specifically within its security framework. This flaw allows attackers with low privileges and network access via T3 and IIOP protocols to exploit the application. The vulnerability primarily affects version 21.8.3.0.0 but may also impact other interconnected products. Successful exploitation enables attackers to compromise Oracle Essbase, potentially allowing for significant disruption and unauthorized control. It is critical for users to apply security updates to mitigate these risks.

Affected Version(s)

Oracle Essbase 21.8.3.0.0

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.