Zero Radar
← feed
CriticalVulnerabilityCVE-2026-91658updated 25 Oct 2026, 18:50 UTC

Oracle Essbase flaw lets low-privileged users take over the server

A flaw in Oracle Essbase, a business data analysis tool, lets someone with a basic user account reach over the network and gain full control of the server. That can expose or change the data it holds and affect other connected systems.

Official, 2 sources
SeverityCriticalCVSS 9.9 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Low-privileged attackerHolds only a basic account
  2. 2HTTP requestReaches Essbase over the network
  3. 3Security flaw exploitedFlaw in the Security component
  4. 4Server takeoverFull control of Essbase host
  5. ResultAttacker takes over Essbase and affects other products

What happened

A vulnerability in the Security component of Oracle Essbase 21.8.3.0.0 can be exploited over HTTP by a low-privileged attacker with network access, leading to full compromise of confidentiality, integrity and availability, with scope change to other products.

Why it is dangerous: Successful exploitation allows complete takeover of the Essbase server and may spill over into other connected products. Organizations running Essbase that allow network access from users or other systems are at risk.

Are you affected?

You are affected if you run Oracle Essbase version 21.8.3.0.0 and users or systems with low-privileged accounts can reach it over the network via HTTP.

Oracle Essbase 21.8.3.0.0

What to do

  1. Check whether your Oracle Essbase instance runs version 21.8.3.0.0
  2. Apply the official Oracle Critical Patch Update or vendor fix for this advisory as soon as it is available
  3. Restrict network access to Essbase HTTP endpoints to only the users and systems that need them
  4. Review accounts with low privileges and remove any that are unnecessary

Timeline

  1. 20 Oct 2026, 22:21 UTC
    Publicly disclosed
  2. 20 Oct 2026, 22:21 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 18:50 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-91658 · GHSA-qpc3-rr6m-h39q
CVSS
9.9 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
20 Oct 2026, 22:21 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 18:50 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Oracle Essbase flaw lets low-privileged users take over the server · Zero Radar