CVE-2026-91664: Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Essbase. in Oracle Corporation Oracle Essbase

This vulnerability affects Oracle Essbase component Security in version 21.8.3.0.0. An unauthenticated attacker with network access via TCP can exploit this flaw to cause the application to hang or crash repeatedly, resulting in a complete denial of service. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms that the attack requires no privileges or user interaction and impacts availability only. Oracle has published this issue in its October 2026 Critical Patch Update advisory, which contains numerous patches addressing multiple vulnerabilities across Oracle products.

Successful exploitation results in denial of service by causing Oracle Essbase to hang or crash repeatedly. There is no impact on confidentiality or integrity. The vulnerability can be exploited remotely without authentication, making it a significant availability risk for affected systems.

Oracle has released security patches addressing this vulnerability as part of its October 2026 Critical Patch Update. Users of Oracle Essbase version 21.8.3.0.0 should apply the relevant patches from this update promptly to remediate the issue. No alternative mitigations or workarounds are specified in the advisory. Patch status is confirmed as available via the Oracle advisory.