CVE-2026-70688
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Vulnerability in Oracle Essbase (Calculator component) version 21.8.1.0.0. A low privileged attacker with network access via HTTP can take over the system. CVSS 8.8 (Confidentiality, Integrity, Availability impacts).
Risk Assessment
Risk includes complete takeover of Oracle Essbase, potentially leading to breach of analytical data and service disruption.
Recommendation
Apply Oracle patches, restrict HTTP access, and control user privileges.
Other vulnerabilities in Oracle Essbase
See all- CVE-2026-70689Critical
Vulnerability in Oracle Essbase (component: Infrastructure) version 21.8.1.0.0. Easily exploitable by an unauthenticated attacker over HTTP, allowing takeover of the system. CVSS score 9.8.
- CVE-2025-61763High
Vulnerability in Oracle Essbase (Essbase Web Platform component) version 21.7.3.0.0. A low-privileged attacker can access via HTTP to compromise data, including unauthorized creation, deletion, or modification. CVSS 8.1.
Original NVD description (English source)
Vulnerability in Oracle Essbase (component: Calculator). The supported version that is affected is 21.8.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS