CVE-2026-91664
HighCVSS 7.5Summary
A vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. An easily exploitable flaw allows an unauthenticated attacker with network access via TCP to cause a hang or frequently repeatable crash (full DoS).
Risk Assessment
Could lead to Oracle Essbase unavailability, disrupting analytics applications that depend on it. Requires only network access, without authentication.
Recommendation
Apply Oracle Critical Patch Update fixes for Oracle Essbase. Restrict network access to the Essbase service to trusted hosts.
Other vulnerabilities in Oracle Essbase
See all- CVE-2026-91661High
A vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or all Oracle Essbase accessible data.
- CVE-2026-91659High
A vulnerability in Oracle Essbase (Build component) affecting version 21.8.3.0.0. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or all Oracle Essbase accessible data.
- CVE-2026-91653High
Vulnerability in Oracle Essbase (component: Essbase Web Platform) affecting version 21.8.3.0.0. A low privileged attacker with network access via HTTP can gain unauthorized access to critical data and update, insert or delete some Essbase data, with possible impact on additional products.
- CVE-2026-91651High
Vulnerability in Oracle Essbase (component: Essbase Web Platform) affecting version 21.8.3.0.0. A difficult to exploit HTTP attack by a low privileged attacker can lead to takeover of Essbase and impact additional products.
- CVE-2026-91647High
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. A difficult to exploit TCP attack by an unauthenticated attacker can lead to takeover of Essbase.
- CVE-2026-91642High
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable HTTP attack by an unauthenticated attacker allows updating, inserting or deleting some data, unauthorized read of a subset of data and partial denial of service.
- CVE-2026-91639High
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable HTTP attack by a low privileged attacker allows unauthorized access to critical data or complete access to all Essbase data, with possible impact on additional products.
- CVE-2026-91636High
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable HTTP attack by a low privileged attacker allows unauthorized access to critical data or complete access to all Essbase data, with possible impact on additional products.
- CVE-2026-91635High
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. A difficult to exploit T3 and IIOP attack by an unauthenticated attacker can lead to takeover of Essbase.
- CVE-2026-91632High
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable HTTP attack by a low privileged attacker allows unauthorized access to critical data or complete access to all Essbase data, with possible impact on additional products.
Original NVD description (English source)
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Essbase. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS