Oracle Essbase: Improper access control allows takeover
Summary
Oracle Essbase 21.8.3.0.0 contains a flaw in its Security component that can be reached over the network via the T3 and IIOP protocols without authentication. An attacker who succeeds can take over the Essbase instance, with high impact on confidentiality, integrity and availability. The attack complexity is rated high, so specific conditions must be met. Oracle addresses the issue in its October 2026 Critical Patch Update.
Affected
- Oracle Essbase 21.8.3.0.0 (per CNA record; other branches not stated)
Fixed in
- Unknown. Take the fixed build and patch ID from the Essbase Risk Matrix in Oracle's October 2026 Critical Patch Update.
Workaround
- No workaround is provided in the CVE record. - Interim measure (recommendation, not from a vendor source): restrict Essbase and its T3/IIOP listeners to required internal hosts and block them from the internet until patched.
Exploitation
- No public proof of concept known. - Not listed in CISA KEV. - CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Check whether Oracle Essbase is installed, including version 21.8.3.0.0. - Verify that T3 and IIOP ports are not reachable from the internet. - Obtain the patch ID from Oracle's October 2026 CPU and apply it, prioritising internet-exposed systems. - Patch the full Essbase set from the same CPU, not only this CVE. - Re-check NVD for the final CWE and CVSS data.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory - October 2026 www.oracle.com
- VulDB - CVE-2026-91635 vuldb.com
- OpenCVE - CVE-2026-91635 app.opencve.io
- VulDB - Exploit status entry 424446 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:12.
Original description (NVD)
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.