---
id: "CVE-2026-91664"
kind: "vulnerability"
aliases: ["CVE-2026-91664"]
title: "Oracle Essbase: unauthenticated network request can crash the server"
severity: "high"
cvss: 7.5
epss: 0.00274
exploited: false
status: "open"
category: "vendor"
products: [{"name": "oracle essbase", "fixed": [], "affected": "= 21.8.3.0.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["oracle-essbase", "self-hosted", "vendor"]
not_affected_if: ["unknown"]
published_at: "2026-10-20T22:21:06+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T03:17:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91664", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91664", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Oracle Essbase: unauthenticated network request can crash the server

Oracle Essbase has a flaw in its Security component that lets an unauthenticated attacker over the network hang or repeatedly crash the service. The impact is availability only, with no code execution or data read in the sources.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:oracle essbase affected = 21.8.3.0.0 fixed ?

## How to check

- Check the installed Essbase version against the affected release `21.8.3.0.0` in the Oracle advisory
- unknown for further checks; the sources do not say how to confirm the Security component is reachable

## Fix

- Apply the Oracle Critical Patch Update fix for Essbase; the fixed version is unknown in the sources
- Restrict network access to the Essbase TCP port to trusted hosts until patched

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91664
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91664

## From the sources

Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Essbase. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_