CVE-2026-91665 is a critical (CVSS 9.8) flaw in the Security component of Oracle Essbase 21.8.3.0.0. An unauthenticated attacker with network access over TCP can exploit it easily to take over the product.
What Is It
CVE-2026-91665 is a vulnerability in the Security component of Oracle Essbase. Oracle reported it, and NVD published the record on October 20, 2026. NVD currently lists its status as "Received."
Oracle's description says the flaw is "easily exploitable" and lets an unauthenticated attacker with network access via TCP compromise Oracle Essbase. A successful attack can result in full takeover of the product.
Why It Matters
Oracle scores the flaw CVSS 3.1 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In practice:
- Attack Vector: Network. It can be exploited remotely.
- Attack Complexity: Low. No special conditions are needed.
- Privileges Required: None. No credentials are needed.
- User Interaction: None. No victim action is needed.
- Impact: High for confidentiality, integrity and availability.
The exploitability subscore is 3.9 and the impact subscore is 5.9. A remote attacker who needs no login or user action and can fully take over the product makes this a high priority for any organization running the affected version.
The supplied CISA Known Exploited Vulnerabilities (KEV) data has no entry for this CVE. Based on that data, active exploitation is not confirmed, and no CISA required action or due date applies.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Essbase
- Component: Security
- Affected version: 21.8.3.0.0
The NVD record lists no affected CPEs yet.
Patch Status
NVD's only reference is Oracle's October 2026 Critical Patch Update (CPU) advisory. Organizations running Oracle Essbase 21.8.3.0.0 should check that advisory for fix and remediation guidance and apply the relevant patches. Since the flaw is reachable over the network without authentication, defenders should also check whether Essbase is exposed to untrusted networks while they roll out patches.
Sources
- NVD, CVE-2026-91665
- Oracle Critical Patch Update Advisory; October 2026
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE in the supplied data)