{"id":"CVE-2026-91665","published":"2026-10-20T22:21:06.960","lastModified":"2026-10-22T23:20:33.240","description":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287","CWE-306"],"vendors":["oracle"],"products":["essbase"],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Oracle Essbase security vulnerability allows unauthenticated attackers to fully compromise the system with high impact on confidentiality, integrity, and availability. This critical flaw affects version 21.8.3.0.0 and can be exploited over TCP network access.","exploitability":"The vulnerability is easily exploitable with no authentication required, allowing attackers to gain full control of Oracle Essbase from any network location with TCP connectivity.","blast_radius":"Successful exploitation could lead to complete takeover of Oracle Essbase systems, potentially affecting financial reporting, data analysis, and business intelligence applications that depend on this platform.","remediation":"Upgrade to Oracle Essbase version 21.8.3.0.0 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["database","security","remote-exploitation"],"model":"garnet-coder","analyzedAt":"2026-10-21T01:25:38.647Z"}}