CVE-2026-91663 is a critical (CVSS 3.1 9.9) vulnerability in the Security component of Oracle Essbase 21.8.3.0.0. An attacker with low privileges and network access over T3 or IIOP can exploit it easily to take over Essbase.
What Is It
CVE-2026-91663 is in the Security component of Oracle Essbase. Oracle calls it "easily exploitable": an attacker who has low-level privileges and network access through the T3 or IIOP protocols can compromise Oracle Essbase. A successful attack can result in full takeover of the product.
Oracle ([email protected]) assigned the CVE. NVD published the record on 2026-10-20, and its status is currently "Received."
Why It Matters
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. That gives a base score of 9.9 (CRITICAL), with an exploitability subscore of 3.1 and an impact subscore of 6.0. In practice, the vector means:
- Network-reachable: It can be attacked remotely over the network.
- Low complexity: Exploitation needs no special conditions.
- Low privileges required: Any authenticated, low-privileged account is enough.
- No user interaction: No victim has to take any action.
- Scope changed: The flaw is in Essbase, but Oracle says attacks "may significantly impact additional products."
- High impact on confidentiality, integrity and availability.
The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm active exploitation. Still, a low-privilege, network-exploitable flaw with a scope change and full takeover impact should be a high patching priority for any organization running Essbase.
What's Vulnerable
| Vendor | Product | Affected Version |
|---|---|---|
| Oracle Corporation | Oracle Essbase | 21.8.3.0.0 |
Oracle's description says 21.8.3.0.0 is the affected supported version. Attacks come in through the T3 and IIOP protocols. The NVD record does not yet list any CPE entries.
Patch Status
The NVD record links to Oracle's October 2026 Critical Patch Update (CPU) advisory. Essbase administrators should read that advisory for fix details and apply the relevant patch for 21.8.3.0.0. The supplied data does not name a fixed version.
CISA has issued no KEV required action or remediation due date, because the CVE is not in the KEV catalog.
Until the patch is applied, defenders should reduce exposure by limiting network access to Essbase T3 and IIOP endpoints to trusted hosts only, and by reviewing which accounts hold even low-level Essbase privileges.
Sources
- Oracle Critical Patch Update Advisory – October 2026
- NVD – CVE-2026-91663
- CISA Known Exploited Vulnerabilities Catalog (not listed at time of writing)