Oracle Essbase: Improper access control leads to takeover
Summary
Oracle Essbase 21.8.3.0.0 contains an improper access control vulnerability (CWE-284) that can be exploited over the network via T3 and IIOP. An attacker with a low-privileged account can compromise Essbase, and the impact can extend to other products because the scope changes. Oracle rates the issue CVSS 9.9 (critical), and a complete takeover of Essbase is possible.
Affected
- Oracle Essbase 21.8.3.0.0 (per Oracle CNA record)
Fixed in
Unknown. Check the Oracle October 2026 CPU advisory and My Oracle Support for the Essbase patch that covers CVE-2026-91663.
Workaround
Unknown. No vendor workaround found in the sources reviewed.
- Restrict T3 and IIOP access to trusted networks only (our recommendation, not from the sources).
Exploitation
- Not listed in CISA KEV at the time of research.
- CISA SSVC: Exploitation none, Automatable no.
- No public exploit code confirmed as of 30 Oct 2026. Recheck CISA KEV.
Our recommendation
- Check whether Oracle Essbase is installed at all.
- Apply the Essbase patch from the October 2026 CPU once the covering patch ID is confirmed.
- Block T3 and IIOP from untrusted networks and do not expose Essbase to the internet.
- Review and limit low-privileged accounts.
- Monitor Essbase logs for unusual activity until patching is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory - October 2026 www.oracle.com
- OpenCVE: CVE-2026-91663 app.opencve.io
- CVE-2026-91663 on threatint CVE mirror cve.threatint.com
- TheHackerWire: CVE-2026-91663 www.thehackerwire.com
- Tenable: Oracle October 2026 CPU analysis www.tenable.com
- Waratek: Oracle October 2026 CPU waratek.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:02.
Original description (NVD)
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.