---
id: "CVE-2026-91665"
kind: "vulnerability"
aliases: ["CVE-2026-91665"]
title: "Oracle Essbase: unauthenticated network flaw allows full takeover of server"
severity: "critical"
cvss: 9.8
epss: 0.00412
exploited: false
status: "open"
category: "vendor"
products: [{"name": "oracle essbase", "fixed": [], "affected": "= 21.8.3.0.0", "ecosystem": "vendor"}, {"name": "essbase", "fixed": [], "affected": "21.8.3.0.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["oracle-essbase", "self-hosted", "vendor"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-20T22:21:06+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-24T13:15:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91665", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:53:00+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91665", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Oracle Essbase: unauthenticated network flaw allows full takeover of server

Oracle Essbase 21.8.3.0.0 has a Security-component flaw that an unauthenticated attacker can reach over TCP and use to take over the server (CVSS 3.1 9.8). Oracle fixed it in the October 2026 CPU, one of 38 Essbase fixes in that release. No exploitation or PoC reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:oracle essbase affected = 21.8.3.0.0 fixed ?
- vendor:essbase affected 21.8.3.0.0 fixed ?

## How to check

Check your Essbase release: 21.8.3.0.0 is the affected version. Then check whether the October 2026 CPU Essbase patch is applied (per the MOS patch availability document). Check whether the Essbase TCP listener is reachable from untrusted networks.

## Fix

Apply the Oracle October 2026 CPU patch for Essbase from My Oracle Support (patch availability doc linked from cpuoct2026). Oracle gives no new version string in the sources I read. Until patched, firewall the Essbase TCP ports to trusted hosts only. The same CPU fixes 38 Essbase flaws, so patch them all together.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91665
- 2026-10-23T22:53:00+00:00 analyst — Oracle October 2026 CPU (cpuoct2026) lists Essbase 21.8.3.0.0 as affected; the fix is the CPU patch via My Oracle Support. No fixed version string is published in the pages I could read; the patch number sits in the MOS Essbase patch availability doc, which I did not open. No exploitation or PoC found. I did not search X or Bluesky.
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91665

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [advisory] Text Form of Oracle CPU October 2026 Risk Matrices https://www.oracle.com/security-alerts/cpuoct2026verbose.html
- [mentions] Waratek: Oracle October 2026 CPU (Essbase section) https://waratek.com/news/oracle-releases-the-october-2026-critical-patch-update/

## From the sources

Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_