CVE-2026-91635
HighCVSS 8.1Summary
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. A difficult to exploit T3 and IIOP attack by an unauthenticated attacker can lead to takeover of Essbase.
Risk Assessment
An unauthenticated attacker could take over Essbase, threatening confidentiality, integrity and availability. CVSS 8.1 indicates high risk.
Recommendation
Update Oracle Essbase to the fixed version and restrict network access to T3 and IIOP services.
Other vulnerabilities in Oracle Essbase
See all- CVE-2026-91664High
A vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. An easily exploitable flaw allows an unauthenticated attacker with network access via TCP to cause a hang or frequently repeatable crash (full DoS).
- CVE-2026-91661High
A vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or all Oracle Essbase accessible data.
- CVE-2026-91659High
A vulnerability in Oracle Essbase (Build component) affecting version 21.8.3.0.0. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or all Oracle Essbase accessible data.
- CVE-2026-91653High
Vulnerability in Oracle Essbase (component: Essbase Web Platform) affecting version 21.8.3.0.0. A low privileged attacker with network access via HTTP can gain unauthorized access to critical data and update, insert or delete some Essbase data, with possible impact on additional products.
- CVE-2026-91651High
Vulnerability in Oracle Essbase (component: Essbase Web Platform) affecting version 21.8.3.0.0. A difficult to exploit HTTP attack by a low privileged attacker can lead to takeover of Essbase and impact additional products.
- CVE-2026-91647High
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. A difficult to exploit TCP attack by an unauthenticated attacker can lead to takeover of Essbase.
- CVE-2026-91642High
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable HTTP attack by an unauthenticated attacker allows updating, inserting or deleting some data, unauthorized read of a subset of data and partial denial of service.
- CVE-2026-91639High
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable HTTP attack by a low privileged attacker allows unauthorized access to critical data or complete access to all Essbase data, with possible impact on additional products.
- CVE-2026-91636High
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable HTTP attack by a low privileged attacker allows unauthorized access to critical data or complete access to all Essbase data, with possible impact on additional products.
- CVE-2026-91632High
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable HTTP attack by a low privileged attacker allows unauthorized access to critical data or complete access to all Essbase data, with possible impact on additional products.
Original NVD description (English source)
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS