EUVD-2026-106822
GHSA-f9f5-8jhw-82j2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach T3/IIOP listener over network
-
ExploitSend crafted protocol request to Security component
-
ExecutionSatisfy difficult exploit preconditions
-
ImpactAchieve full Essbase takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the Oracle Essbase server's WebLogic T3 and/or IIOP remoting listeners - not HTTP/HTTPS - which are typically bound to internal application-tier networks and frequently firewalled from untrusted zones, significantly limiting realistic exposure. No authentication and no user interaction are required (PR:N/UI:N). The dominant limiting factor is the 'difficult to exploit' rating (AC:H): the attacker must satisfy conditions outside their direct control beyond merely reaching the port. Affected deployments are specifically Oracle Essbase version 21.8.3.0.0; environments that restrict or disable external T3/IIOP access, or that have applied the October 2026 CPU, are not exposed. |
| Impact | This is a high-severity flaw (CVSS 3.1 base 8.1) in Oracle Essbase's Security component permitting full product takeover with complete confidentiality, integrity, and availability impact (C:H/I:H/A:H). The vector is network-reachable and unauthenticated (AV:N/PR:N/UI:N), which raises concern, but it is explicitly rated 'difficult to exploit' (AC:H) by Oracle, meaning successful attack requires conditions beyond the attacker's direct control (e.g. winning a race, specific state, or non-trivial preparation). Key exploitation-maturity signals are absent from the input: there is no CISA KEV listing, no POC indicator, and no EPSS score supplied, so there is no evidence of active or imminent exploitation - this reads as a real but not emergency priority. The exposure is further bounded by the attack surface: compromise occurs over the T3 and IIOP protocols (WebLogic remoting/RMI channels), which in well-managed deployments are not Internet-exposed and are restricted to internal or application-tier networks. Net: treat as an important patch-cycle item (part of Oracle's October 2026 CPU) rather than a drop-everything zero-day, while noting that unauthenticated network takeover of a BI/OLAP data platform warrants prompt remediation where T3/IIOP are reachable. |
| Exploit ScenarioDerived | An attacker with network reachability to an Oracle Essbase instance's WebLogic T3 or IIOP listener sends a crafted request that abuses a flaw in the Security component, and after satisfying the difficult-to-meet preconditions (AC:H) achieves full takeover of Essbase without any credentials or user interaction. No public exploit code or active exploitation has been identified at time of analysis, so this remains a theoretical-but-credible scenario grounded in the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Unauthenticated network attackers can achieve full takeover of Oracle Essbase 21.8.3.0.0 by reaching the product's WebLogic T3 and/or IIOP remoting listeners, with complete confidentiality, integrity, and availability impact (CVSS 3.1 base 8.1, C:H/I:H/A:H). The flaw sits in the Security component and is rated difficult to exploit (AC:H), meaning the attacker must satisfy conditions outside their direct control beyond simply reaching the port; no user interaction is required (PR:N/UI:N). There is no public exploit code and no confirmed active exploitation at time of analysis, but exposure is real wherever T3/IIOP is reachable from untrusted networks - the October 2026 Oracle Critical Patch Update is the only fix path identified in the available data.
RemediationAI
Apply the October 2026 Oracle Critical Patch Update for Oracle Essbase as published at https://www.oracle.com/security-alerts/cpuoct2026.html - that advisory is the only patch source identified in the available data and enumerates the exact patched build for the 21.8.3.0.0 line; the specific fixed version string is not included in the supplied intelligence, so confirm it against the CPU page rather than guessing. If the CPU cannot be applied immediately, the highest-value compensating control is to close the exposure path rather than the payload: restrict network access to the WebLogic T3 and IIOP listeners with host firewalls or network segmentation so that only trusted application-tier hosts can reach them, accepting that legitimate remote clients and any co-located integrations using those protocols will break. Administrators can also disable IIOP entirely if it is unused, and, where the deployment permits, disable or filter the T3 protocol and enable WebLogic's connection filter (weblogic.security.net.ConnectionFilterImpl) to allowlist source addresses - this carries the same breakage risk for any T3-dependent client and requires careful testing, since Essbase components may rely on T3 for internal cluster communication. Do not rely on the HTTP administration console being disabled as a mitigation, because the vulnerable path is the remoting layer, and note that no vendor workaround is documented in the available data beyond applying the CPU.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Essbase is an OLAP/multidimensional analytics server that in current 21.x releases runs atop Oracle WebLogic Server, exposing the standard WebLogic remoting protocols - T3 and IIOP - in addition to HTTP/HTTPS administration and application endpoints. Those remoting listeners are the attack surface named in the CVE record, and they are a well-known class of entry point for Java application servers because they carry serialized objects and remote invocations rather than simple HTTP requests. The CVE record carries no CWE mapping, so the precise root-cause class (for example a deserialization, access-control, or authentication-bypass defect in the Security component) is not confirmed by the available data; what is confirmed is the pre-authentication (PR:N), no-interaction (UI:N) path over the network (AV:N) with high AC:H complexity and unchanged scope (S:U). Because the affected component is identified only as 'Security', defenders should treat the T3/IIOP listeners themselves - not a specific servlet or REST endpoint - as the thing needing isolation, since the vulnerable code path may not be reachable through the HTTP administration console at all.
Know when Essbase gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network reach over T3/IIOP gives AV:N/PR:N/UI:N; the vendor's 'difficult to exploit' qualifier justifies AC:H; full takeover yields C:H/I:H/A:H with no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Essbase 21.8.3.0.0 carries a high-severity security flaw in its Security component that lets an unauthenticated network attacker who can reach the product's WebLogic T3 and/or IIOP remoting listeners achieve full takeover of the system, with complete loss of confidentiality, integrity, and availability. Any Essbase deployment with those listeners exposed beyond trusted network boundaries puts the finance and analytics data it hosts, and the surrounding Oracle estate, at risk of compromise. Leadership should care because no vendor patch is currently available, exploitation is rated difficult but requires no credentials or user interaction, and the only identified fix path is the October 2026 Oracle Critical Patch Update, leaving a potentially extended window of exposure.
No vendor patch is currently available; interim mitigations are network-level only. Restrict WebLogic T3 and IIOP remoting listeners on Oracle Essbase 21.8.3.0.0 to trusted management networks via firewall rules and segmentation, disable T3/IIOP where not operationally required, place the listeners behind an application-aware proxy or WAF where feasible, and enable and monitor WebLogic/Essbase security logs for anomalous T3/IIOP connection and authentication activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verificatio
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcar
This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. Rat
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Acto
Oracle Essbase 21.8.3.0.0 (Security component) permits a low-privileged authenticated user to take full control of the E
Authenticated low-privileged attackers with network access to Oracle Essbase 21.8.3.0.0's T3/IIOP listeners can achieve
Remote takeover of Oracle Essbase 21.8.3.0.0 is possible for low-privileged authenticated attackers with HTTP network ac
Oracle Essbase 21.8.3.0.0 contains an easily exploitable flaw in its Security component that lets a low-privileged, netw
Exploit-DB