CVE-2026-91665: Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in takeover of Oracle Essbase. in Oracle Corporation Oracle Essbase

This vulnerability in Oracle Essbase (Security component) version 21.8.3.0.0 allows an unauthenticated attacker with network access via TCP to compromise the system, potentially leading to complete takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires no privileges or user interaction and can be executed remotely with low complexity. Oracle has included a fix for this vulnerability in its October 2026 Critical Patch Update, which contains 1295 security patches across multiple products. The vendor strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can result in full compromise of Oracle Essbase, impacting confidentiality, integrity, and availability of the system. The vulnerability is remotely exploitable without authentication, making it highly critical. There are no known exploits in the wild at this time, but the ease of exploitation and severity of impact pose a significant risk if unpatched.

Oracle has released a security patch for this vulnerability as part of the October 2026 Critical Patch Update. Customers should apply the official patch to Oracle Essbase version 21.8.3.0.0 immediately. Oracle advises remaining on actively supported versions and applying security patches promptly to mitigate exploitation risks. No alternative mitigations or workarounds are specified in the advisory.