---
id: "CVE-2026-91635"
kind: "vulnerability"
aliases: ["CVE-2026-91635"]
title: "Oracle Essbase: unauthenticated network attacker can take over the server"
severity: "high"
cvss: 8.1
epss: 0.00255
exploited: false
status: "open"
category: "vendor"
products: [{"name": "oracle essbase", "fixed": [], "affected": "= 21.8.3.0.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["java", "oracle-essbase", "self-hosted", "vendor"]
not_affected_if: ["no-t3-iiop-exposure", "other-essbase-versions"]
published_at: "2026-10-20T22:21:03+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T03:06:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91635", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91635", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Oracle Essbase: unauthenticated network attacker can take over the server

Oracle Essbase 21.8.3.0.0 has a flaw in its Security component that is reachable over the network through the T3 and IIOP protocols. An unauthenticated attacker who succeeds can take full control of the Essbase server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:oracle essbase affected = 21.8.3.0.0 fixed ?

## How to check

- Confirm the Essbase version with the installed Oracle Essbase build; affected version listed is `21.8.3.0.0`
- Check whether T3 or IIOP listeners are reachable from untrusted networks, which the sources do not detail further: unknown

## Fix

- Apply the Oracle Critical Patch Update fix for Essbase; the fixed version is unknown from the sources
- Restrict network access to Essbase T3 and IIOP ports until patched

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91635
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91635

## From the sources

Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_