Oracle Essbase 21.8.3.0.0 Exposed to Unauthenticated Data Manipulation

Oracle Essbase version 21.8.3.0.0 contains a critical security vulnerability that permits unauthenticated network access. This flaw allows attackers to compromise the system via HTTP without needing valid credentials.

What happened

The National Vulnerability Database records CVE-2026-91644 as a high-severity issue within the Security component of Oracle Essbase. The specific affected release is version 21.8.3.0.0. According to the NVD, this vulnerability is easily exploitable by an attacker with network access. The attack vector is remote, requiring no user interaction or authentication.

The flaw resides in how Oracle Essbase handles security controls. An attacker can send HTTP requests to the affected system. These requests bypass standard authentication checks. The vulnerability allows for complete access to all accessible data within the application. It also permits unauthorized modification of that data.

Why it matters

The CVSS 3.1 base score for this flaw is 9.3. This rating falls into the critical severity range. The vector string indicates high confidentiality impact and low integrity impact. However, the scope of the attack changes significantly. The NVD notes that attacks may impact additional products beyond the initial component.

Successful exploitation results in unauthorized access to critical data. Attackers can insert, update, or delete records within the system. This level of access compromises the integrity of the entire database. The lack of authentication requirements lowers the barrier for exploitation. Any system with network exposure to the HTTP service is at risk.

What to watch

• Monitor for unusual HTTP traffic patterns targeting Essbase services.
• Look for data modifications made outside of normal business hours.
• Check for access attempts from unknown IP addresses.
• Verify that all Essbase instances are not running version 21.8.3.0.0.

Signals worth monitoring

Security teams should examine web server logs for unauthenticated requests to Essbase endpoints. Look for successful HTTP responses that return data without prior login sequences. Alert on any data modification events that lack associated user identities. Check for spikes in database write operations from external sources. Verify that network segmentation prevents direct internet access to these services. Review firewall logs for connections to known Essbase ports. Investigate any anomalies in data volume or structure integrity. Ensure monitoring tools capture full request payloads for forensic analysis.

Background: Network segmentation

Network segmentation divides a large network into smaller, isolated sub-networks. This restricts traffic flow based on strict rules, preventing attackers from moving freely between systems after an initial breach. It reduces the attack surface and contains potential damage by enforcing strict access controls between zones.

Read the full guide: Network Segmentation: Stop Lateral Movement Before It Starts

What to do and how to stay safe: Oracle Essbase

• Verify if your environment runs Oracle Essbase version 21.8.3.0.0.
• Implement network restrictions to limit HTTP access to trusted IPs.
• Monitor logs for unauthenticated access attempts and data changes.
• Prepare to apply updates once the vendor provides a fix.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Oracle Essbase version is affected by CVE-2026-91644?

Only version 21.8.3.0.0 is listed as affected in the NVD record.

What is the severity rating of this vulnerability?

The CVSS 3.1 base score is 9.3, which is rated as critical.

Can an attacker exploit this without a password?

Yes, the vulnerability allows unauthenticated access via HTTP.