---
id: "CVE-2026-91663"
kind: "vulnerability"
aliases: ["CVE-2026-91663"]
title: "Oracle Essbase: low-privilege network attacker can take over the server"
severity: "critical"
cvss: 9.9
epss: 0.00286
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "oracle essbase", "fixed": [], "affected": "= 21.8.3.0.0", "ecosystem": "vendor"}, {"name": "essbase", "fixed": [], "affected": "21.8.3.0.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["infrastructure", "oracle-essbase", "self-hosted"]
not_affected_if: ["managed-hosting", "unknown"]
published_at: "2026-10-20T22:21:06+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-24T13:15:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91663", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:54:15+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91663", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Oracle Essbase: low-privilege network attacker can take over the server

Oracle Essbase 21.8.3.0.0 has a flaw in the Security component reachable over T3 and IIOP. An attacker with low-privilege credentials can take over Essbase, and the changed scope can affect other products. CVSS 9.9. Fixed in the October 2026 Critical Patch Update; the patch details are in the My Oracle Support patch availability document for Database.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:oracle essbase affected = 21.8.3.0.0 fixed ?
- vendor:essbase affected 21.8.3.0.0 fixed ?

## How to check

Check whether you run Oracle Essbase 21.8.3.0.0 and whether its T3/IIOP ports are reachable from untrusted networks. Compare your installed patch level with the October 2026 CPU patch listed in the Oracle MOS 'Database' patch availability document (login required).

## Fix

Apply the Essbase patch from Oracle's October 2026 CPU via the MOS patch availability document. The fixed version is unknown: Oracle's public page names none. Until patched, restrict network access to the T3/IIOP ports to trusted hosts. This is general hardening, not an Oracle-confirmed mitigation.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91663
- 2026-10-23T22:54:15+00:00 analyst — Oracle CPU Oct 2026 lists Essbase 21.8.3.0.0 as affected; patch is via the 'Database' patch availability doc (My Oracle Support, not public), so no fixed version is readable. CVSS 3.1 9.9 (AV:N/AC:L/PR:L/S:C) per tracker; not in KEV, no public PoC seen. T3/IIOP disable not confirmed by Oracle. No X search done.
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91663

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE-2026-91663 (Hackerwire tracker) https://www.thehackerwire.com/vulnerability/CVE-2026-91663/

## From the sources

Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_