CVE-2026-91663: Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. in Oracle Corporation Oracle Essbase

This vulnerability affects the Security component of Oracle Essbase version 21.8.3.0.0. It is easily exploitable by an attacker with low privileges and network access via T3 or IIOP protocols. Exploitation can result in complete compromise of Oracle Essbase, with a scope change potentially affecting additional Oracle products. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impacts on confidentiality, integrity, and availability. Oracle has included a fix for this vulnerability in its October 2026 Critical Patch Update.

Successful exploitation of CVE-2026-91663 allows an attacker to take over Oracle Essbase, resulting in full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability's scope change means that additional Oracle products may also be impacted indirectly. The CVSS score of 9.9 reflects the critical severity and potential for significant operational disruption.

Oracle has released an official fix for this vulnerability as part of the October 2026 Critical Patch Update. Users of Oracle Essbase version 21.8.3.0.0 should apply the provided security patches promptly to remediate this vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation.