Unauthenticated Network Access Vulnerability in Oracle Essbase
CVE-2026-91664

7.5HIGH

Key Information:

Vendor

Oracle
Status
Oracle Essbase
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91664?

A vulnerability exists in Oracle Essbase that allows unauthenticated attackers with TCP network access to exploit the system. The affected version is 21.8.3.0.0. Successful exploitation may lead to the unauthorized ability to cause a hang or frequent crashes of the Oracle Essbase component, which could ultimately lead to a denial of service. It is crucial for organizations using this software to address the vulnerability immediately to mitigate potential disruptions to their services.

Affected Version(s)

Oracle Essbase 21.8.3.0.0

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.