{"id":"CVE-2026-91663","kind":"vulnerability","aliases":["CVE-2026-91663"],"related":[],"title":"Oracle Essbase: low-privilege network attacker can take over the server","description":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","summary":"Oracle Essbase 21.8.3.0.0 has a flaw in the Security component reachable over T3 and IIOP. An attacker with low-privilege credentials can take over Essbase, and the changed scope can affect other products. CVSS 9.9. Fixed in the October 2026 Critical Patch Update; the patch details are in the My Oracle Support patch availability document for Database.","severity":"critical","cvss":9.9,"epss":0.00286,"exploited":false,"exploited_at":null,"products":[{"name":"oracle essbase","fixed":[],"affected":"= 21.8.3.0.0","ecosystem":"vendor"},{"name":"essbase","fixed":[],"affected":"21.8.3.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","oracle-essbase","self-hosted"],"not_affected_if":["managed-hosting","unknown"],"how_to_check":"Check whether you run Oracle Essbase 21.8.3.0.0 and whether its T3/IIOP ports are reachable from untrusted networks. Compare your installed patch level with the October 2026 CPU patch listed in the Oracle MOS 'Database' patch availability document (login required).","fix":"Apply the Essbase patch from Oracle's October 2026 CPU via the MOS patch availability document. The fixed version is unknown: Oracle's public page names none. Until patched, restrict network access to the T3/IIOP ports to trusted hosts. This is general hardening, not an Oracle-confirmed mitigation.","status":"open","published_at":"2026-10-20T22:21:06+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:33:35+00:00","updated_at":"2026-10-24T13:15:55+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T22:33:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Essbase: low-privilege network attacker can take over the server","impact":"high","summary":"Oracle Essbase 21.8.3.0.0 has a flaw in its Security component reachable over the network through the T3 and IIOP protocols. A user with low privileges can take over the Essbase server and, because of scope change, affect other products.","category":"infrastructure","who_cares":["oracle-essbase","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker takes over the Essbase server and reaches connected systems.","analyst_note":"Check the Oracle Critical Patch Update advisory for the fixed version and whether T3/IIOP can be disabled; the NVD entry gives no fix or check steps.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000482,"input_tokens":3087,"output_tokens":347,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the Oracle Critical Patch Update advisory for the fixed version and whether T3/IIOP can be disabled; the NVD entry gives no fix or check steps.","search":"'-2026':14A,17A '-91663':15A,18A '/av':159C '2026':69B '21.8.3.0.0':31B,100C '3.1':146C,158C '9.9':64B,149C 'access':110C 'addit':129C 'affect':60B,98C 'allow':104C 'attack':7A,45B,107C,125C,134C 'avail':83B,153C 'base':147C 'c/c':164C 'chang':57B,132C 'compon':38B,91C 'compromis':115C 'confidenti':150C 'credenti':50B 'critic':70B 'cve':13A,16A 'cvss':63B,145C,155C,157C 'databas':86B 'detail':75B 'document':84B 'easili':101C 'essbas':2A,25B,30B,54B,90C,117C,124C,144C 'essbase':20A,21A 'exploit':102C 'fix':65B 'flaw':34B 'h':167C 'h/a':166C 'h/i':165C 'host':28B 'iiop':43B,113C 'impact':128C,154C 'infrastructur':22B 'integr':151C 'l/pr':161C 'l/ui':162C 'low':4A,48B,105C 'low-privileg':3A,47B 'may':126C 'n/ac':160C 'n/s':163C 'network':6A,109C 'octob':68B 'oracl':1A,24B,29B,80B,89C,116C,123C,143C 'oracle':19A 'oracle-essbas':23B 'patch':71B,74B,82B 'privileg':5A,49B,106C 'product':62B,130C 'reachabl':39B 'result':139C 'scope':58B,131C 'score':148C 'secur':37B,92C 'self':27B 'self-host':26B 'server':12A 'signific':127C 'success':133C 'support':81B,94C 't3':41B,112C 'take':9A,52B 'takeov':141C 'updat':72B 'vector':156C 'version':95C 'via':111C 'vulner':87C,103C,120C,137C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:21:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91663","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91663","severity":null,"published_at":"2026-10-20T22:21:06+00:00","modified_at":"2026-10-23T17:18:32+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91663:321","url":null,"severity":null,"published_at":"2026-10-23T22:54:15+00:00","modified_at":"2026-10-23T22:54:15+00:00","first_seen_at":"2026-10-23T22:54:15+00:00","fetched_at":"2026-10-23T22:54:15+00:00","note":"Oracle CPU Oct 2026 lists Essbase 21.8.3.0.0 as affected; patch is via the 'Database' patch availability doc (My Oracle Support, not public), so no fixed version is readable. CVSS 3.1 9.9 (AV:N/AC:L/PR:L/S:C) per tracker; not in KEV, no public PoC seen. T3/IIOP disable not confirmed by Oracle. No X search done."},{"source":"epss","external_id":"CVE-2026-91663","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91663","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1658,"url":"https://www.thehackerwire.com/vulnerability/CVE-2026-91663/","title":"CVE-2026-91663 (Hackerwire tracker)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}