{"id":"CVE-2026-91635","kind":"vulnerability","aliases":["CVE-2026-91635"],"related":[],"title":"Oracle Essbase: unauthenticated network attacker can take over the server","description":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Essbase 21.8.3.0.0 has a flaw in its Security component that is reachable over the network through the T3 and IIOP protocols. An unauthenticated attacker who succeeds can take full control of the Essbase server.","severity":"high","cvss":8.1,"epss":0.00255,"exploited":false,"exploited_at":null,"products":[{"name":"oracle essbase","fixed":[],"affected":"= 21.8.3.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["java","oracle-essbase","self-hosted","vendor"],"not_affected_if":["no-t3-iiop-exposure","other-essbase-versions"],"how_to_check":"- Confirm the Essbase version with the installed Oracle Essbase build; affected version listed is `21.8.3.0.0`\n- Check whether T3 or IIOP listeners are reachable from untrusted networks, which the sources do not detail further: unknown","fix":"- Apply the Oracle Critical Patch Update fix for Essbase; the fixed version is unknown from the sources\n- Restrict network access to Essbase T3 and IIOP ports until patched","status":"open","published_at":"2026-10-20T22:21:03+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:06:00+00:00","updated_at":"2026-10-25T03:06:00+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:06:00Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Essbase; the fixed version is unknown from the sources\n- Restrict network access to Essbase T3 and IIOP ports until patched","reach":"network","title":"Oracle Essbase: unauthenticated network attacker can take over the server","impact":"high","summary":"Oracle Essbase 21.8.3.0.0 has a flaw in its Security component that is reachable over the network through the T3 and IIOP protocols. An unauthenticated attacker who succeeds can take full control of the Essbase server.","category":"vendor","nicknames":[],"who_cares":["oracle-essbase","self-hosted","java"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker takes over the Essbase server over the network","analyst_note":"Confirm the fixed version and patch reference from the Oracle Critical Patch Update advisory linked from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-91635).","how_to_check":"- Confirm the Essbase version with the installed Oracle Essbase build; affected version listed is `21.8.3.0.0`\n- Check whether T3 or IIOP listeners are reachable from untrusted networks, which the sources do not detail further: unknown","needs_analyst":true,"not_affected_if":["other-essbase-versions","no-t3-iiop-exposure"],"who_is_affected":"Organizations running Oracle Essbase 21.8.3.0.0 where the T3 or IIOP interfaces are reachable over the network. Exposure depends on whether those protocols are open to the attacker's network; the sources do not say more.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000654,"input_tokens":3481,"output_tokens":611,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-91635':13A,16A '/av':119C '21.8.3.0.0':29B,75C '3.1':106C,118C '8.1':109C 'access':85C 'affect':73C 'allow':80C 'attack':5A,51B,82C,94C 'avail':113C 'base':107C 'compon':36B,66C 'compromis':90C 'confidenti':110C 'control':57B 'cve':11A,14A 'cvss':105C,115C,117C 'difficult':76C 'essbas':2A,22B,28B,60B,65C,92C,104C 'essbase':18A 'exploit':78C 'flaw':32B 'full':56B 'h':127C 'h/a':126C 'h/i':125C 'h/pr':121C 'host':25B 'iiop':47B,88C 'impact':114C 'integr':111C 'java':19B 'n/ac':120C 'n/s':123C 'n/ui':122C 'network':4A,42B,84C 'oracl':1A,21B,27B,64C,91C,103C 'oracle':17A 'oracle-essbas':20B 'protocol':48B 'reachabl':39B 'result':99C 'score':108C 'secur':35B,67C 'self':24B 'self-host':23B 'server':10A,61B 'succeed':53B 'success':93C 'support':69C 't3':45B,87C 'take':7A,55B 'takeov':101C 'u/c':124C 'unauthent':3A,50B,81C 'vector':116C 'vendor':26B 'version':70C 'via':86C 'vulner':62C,79C,97C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle Essbase 21.8.3.0.0 where the T3 or IIOP interfaces are reachable over the network. Exposure depends on whether those protocols are open to the attacker's network; the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:21:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91635","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91635","severity":null,"published_at":"2026-10-20T22:21:03+00:00","modified_at":"2026-10-23T17:19:29+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91635","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91635","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}