{"id":"CVE-2026-91646","kind":"vulnerability","aliases":["CVE-2026-91646"],"related":[],"title":"Oracle Essbase: unauthenticated network flaw exposes some data and partial denial of service","description":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Essbase accessible data as well as  unauthorized read access to a subset of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 5.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).","summary":"Oracle Essbase 21.8.3.0.0 has a Security component flaw reachable over the network through the T3 and IIOP protocols. An unauthenticated attacker who can meet the hard-to-exploit conditions can read or change a subset of Essbase data and partially disrupt the service.","severity":"medium","cvss":5.6,"epss":0.00251,"exploited":false,"exploited_at":null,"products":[{"name":"oracle essbase","fixed":[],"affected":"= 21.8.3.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["java","on-prem","oracle-essbase","vendor"],"not_affected_if":["no-network-access-to-t3-iiop"],"how_to_check":"- Confirm the installed Essbase version is `21.8.3.0.0` (unknown how to read it from the sources)\n- Check whether T3 or IIOP listeners are reachable from untrusted networks (unknown exact command in sources)","fix":"- Apply the Oracle Critical Patch Update fix for Essbase (fixed version: unknown from the sources)\n- Restrict network access to Essbase T3 and IIOP ports until patched","status":"open","published_at":"2026-10-20T22:21:04+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T04:10:34+00:00","updated_at":"2026-10-25T04:10:34+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:10:34Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Essbase (fixed version: unknown from the sources)\n- Restrict network access to Essbase T3 and IIOP ports until patched","reach":"network","title":"Oracle Essbase: unauthenticated network flaw exposes some data and partial denial of service","impact":"medium","summary":"Oracle Essbase 21.8.3.0.0 has a Security component flaw reachable over the network through the T3 and IIOP protocols. An unauthenticated attacker who can meet the hard-to-exploit conditions can read or change a subset of Essbase data and partially disrupt the service.","category":"vendor","nicknames":[],"who_cares":["oracle-essbase","java","on-prem"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads or alters some Essbase data and partially disrupts service","analyst_note":"Find the fixed Essbase version and patch reference in the Oracle Critical Patch Update advisory for this CVE; NVD page at https://nvd.nist.gov/vuln/detail/CVE-2026-91646.","how_to_check":"- Confirm the installed Essbase version is `21.8.3.0.0` (unknown how to read it from the sources)\n- Check whether T3 or IIOP listeners are reachable from untrusted networks (unknown exact command in sources)","needs_analyst":true,"not_affected_if":["no-network-access-to-t3-iiop"],"who_is_affected":"Teams running Oracle Essbase 21.8.3.0.0 where the T3 or IIOP interfaces are reachable over the network. The sources do not say which deployments are exposed beyond this, so exposure depends on whether those protocols are reachable from untrusted networks.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000678,"input_tokens":3561,"output_tokens":644,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-91646':16A,19A '/av':169C '21.8.3.0.0':32B,87C '3.1':156C,168C '5.6':159C 'abil':142C 'access':97C,118C,124C,131C,138C 'affect':85C 'allow':92C 'attack':50B,94C,106C 'avail':163C 'base':157C 'caus':144C 'chang':63B 'compon':36B,78C 'compromis':102C 'condit':59B 'confidenti':160C 'cve':14A,17A 'cvss':155C,165C,167C 'data':8A,68B,125C,139C 'delet':117C 'denial':11A,147C 'difficult':88C 'disrupt':71B 'dos':151C 'essbas':2A,28B,31B,67B,77C,104C,123C,137C,154C 'essbase':21A 'exploit':58B,90C 'expos':6A 'flaw':5A,37B 'h/pr':171C 'hard':56B 'hard-to-exploit':55B 'iiop':46B,100C 'impact':164C 'insert':115C 'integr':161C 'java':22B 'l':177C 'l/a':176C 'l/i':175C 'meet':53B 'n/ac':170C 'n/s':173C 'n/ui':172C 'network':4A,41B,96C 'on-prem':23B 'oracl':1A,27B,30B,76C,103C,122C,136C,153C 'oracle':20A 'oracle-essbas':26B 'partial':10A,70B,146C,150C 'prem':25B 'protocol':47B 'reachabl':38B 'read':61B,130C 'result':111C 'score':158C 'secur':35B,79C 'servic':13A,73B,149C 'subset':65B,134C 'success':105C 'support':81C 't3':44B,99C 'u/c':174C 'unauthent':3A,49B,93C 'unauthor':113C,129C,141C 'updat':114C 'vector':166C 'vendor':29B 'version':82C 'via':98C 'vulner':74C,91C,109C 'well':127C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle Essbase 21.8.3.0.0 where the T3 or IIOP interfaces are reachable over the network. The sources do not say which deployments are exposed beyond this, so exposure depends on whether those protocols are reachable from untrusted networks.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:21:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91646","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91646","severity":null,"published_at":"2026-10-20T22:21:04+00:00","modified_at":"2026-10-23T14:58:54+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91646","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91646","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}