{"id":"CVE-2026-91665","kind":"vulnerability","aliases":["CVE-2026-91665"],"related":[],"title":"Oracle Essbase: unauthenticated network flaw allows full takeover of server","description":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Essbase 21.8.3.0.0 has a Security-component flaw that an unauthenticated attacker can reach over TCP and use to take over the server (CVSS 3.1 9.8). Oracle fixed it in the October 2026 CPU, one of 38 Essbase fixes in that release. No exploitation or PoC reported.","severity":"critical","cvss":9.8,"epss":0.00412,"exploited":false,"exploited_at":null,"products":[{"name":"oracle essbase","fixed":[],"affected":"= 21.8.3.0.0","ecosystem":"vendor"},{"name":"essbase","fixed":[],"affected":"21.8.3.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["oracle-essbase","self-hosted","vendor"],"not_affected_if":["managed-hosting"],"how_to_check":"Check your Essbase release: 21.8.3.0.0 is the affected version. Then check whether the October 2026 CPU Essbase patch is applied (per the MOS patch availability document). Check whether the Essbase TCP listener is reachable from untrusted networks.","fix":"Apply the Oracle October 2026 CPU patch for Essbase from My Oracle Support (patch availability doc linked from cpuoct2026). Oracle gives no new version string in the sources I read. Until patched, firewall the Essbase TCP ports to trusted hosts only. The same CPU fixes 38 Essbase flaws, so patch them all together.","status":"open","published_at":"2026-10-20T22:21:06+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:33:34+00:00","updated_at":"2026-10-24T13:15:55+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T22:33:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Essbase: unauthenticated network flaw allows full takeover of server","impact":"high","summary":"Oracle Essbase 21.8.3.0.0 has a Security component flaw that an unauthenticated attacker can reach over the network via TCP. Successful exploitation can take over the Essbase server, per the NVD description and a CVSS 3.1 score of 9.8.","category":"vendor","who_cares":["oracle-essbase","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"attacker takes over the Essbase server remotely without credentials","analyst_note":"Find Oracle's Critical Patch Update advisory for the patched Essbase version and the affected-version list at https://nvd.nist.gov/vuln/detail/CVE-2026-91665; sources do not give a fixed version or check steps.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000496,"input_tokens":3047,"output_tokens":383,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for the patched Essbase version and the affected-version list at https://nvd.nist.gov/vuln/detail/CVE-2026-91665; sources do not give a fixed version or check steps.","search":"'-2026':12A,15A '-91665':13A,16A '/av':130C '2026':60B '21.8.3.0.0':29B,88C '3.1':52B,117C,129C '38':64B '9.8':53B,120C 'access':97C 'affect':86C 'allow':6A,92C 'attack':39B,94C,105C 'avail':124C 'base':118C 'compon':34B,79C 'compromis':101C 'confidenti':121C 'cpu':61B 'cve':11A,14A 'cvss':51B,116C,126C,128C 'easili':89C 'essbas':2A,22B,28B,65B,78C,103C,115C 'essbase':18A,19A 'exploit':71B,90C 'fix':55B,66B 'flaw':5A,35B 'full':7A 'h':138C 'h/a':137C 'h/i':136C 'host':25B 'impact':125C 'integr':122C 'l/pr':132C 'n/ac':131C 'n/s':134C 'n/ui':133C 'network':4A,96C 'octob':59B 'one':62B 'oracl':1A,21B,27B,54B,77C,102C,114C 'oracle':17A 'oracle-essbas':20B 'poc':73B 'reach':41B 'releas':69B 'report':74B 'result':110C 'score':119C 'secur':33B,80C 'security-compon':32B 'self':24B 'self-host':23B 'server':10A,50B 'success':104C 'support':82C 'take':47B 'takeov':8A,112C 'tcp':43B,99C 'u/c':135C 'unauthent':3A,38B,93C 'use':45B 'vector':127C 'vendor':26B 'version':83C 'via':98C 'vulner':75C,91C,108C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:21:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91665","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91665","severity":null,"published_at":"2026-10-20T22:21:06+00:00","modified_at":"2026-10-22T23:20:33+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91665:320","url":null,"severity":null,"published_at":"2026-10-23T22:53:00+00:00","modified_at":"2026-10-23T22:53:00+00:00","first_seen_at":"2026-10-23T22:53:00+00:00","fetched_at":"2026-10-23T22:53:00+00:00","note":"Oracle October 2026 CPU (cpuoct2026) lists Essbase 21.8.3.0.0 as affected; the fix is the CPU patch via My Oracle Support. No fixed version string is published in the pages I could read; the patch number sits in the MOS Essbase patch availability doc, which I did not open. No exploitation or PoC found. I did not search X or Bluesky."},{"source":"epss","external_id":"CVE-2026-91665","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91665","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1639,"url":"https://www.oracle.com/security-alerts/cpuoct2026verbose.html","title":"Text Form of Oracle CPU October 2026 Risk Matrices","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1641,"url":"https://waratek.com/news/oracle-releases-the-october-2026-critical-patch-update/","title":"Waratek: Oracle October 2026 CPU (Essbase section)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}