Oracle Essbase CVE-2026-91647

Exploitation is remote and unauthenticated (PR:N, AV:N) over TCP against Oracle Essbase 21.8.3.0.0, requiring no user interaction (UI:N). The decisive LIMITING factor is high attack complexity (AC:H): Oracle classifies this as 'difficult to exploit,' implying the attacker must satisfy specific conditions outside their direct control (e.g., particular timing, state, or configuration) rather than firing a single deterministic request. Oracle's CPU description does not name a specific feature, protocol mode, or non-default setting, so the exact precondition is not disclosed; realistic exposure is further limited by whether the Essbase TCP service is network-reachable from untrusted networks.

Signals are mixed and point to a credible-but-not-urgent priority. The CVSS 3.1 base score of 8.1 (High) reflects a serious outcome - AV:N/PR:N/UI:N means a remote, unauthenticated attacker over TCP with no user interaction, and C:H/I:H/A:H indicates full 'takeover' of Oracle Essbase. However, AC:H (high attack complexity) is the key tempering signal: Oracle explicitly labels this 'difficult to exploit,' meaning the attacker likely needs specific conditions, timing, or knowledge beyond a simple request. No EPSS score was provided, there is no KEV listing, and no public exploit (POC) is referenced - the only source is the Oracle Critical Patch Update (October 2026). There is therefore no evidence of active exploitation; exploitation status is 'no public exploit identified at time of analysis.' Note a tag inconsistency: the input is tagged 'Information Disclosure,' yet the description states the impact is full takeover with High confidentiality, integrity, AND availability impact - treat the impact as full compromise, not mere disclosure. In short, this is a genuinely high-severity flaw worth patching in the normal Oracle CPU cycle, but the AC:H rating plus absence of EPSS/KEV/POC data argues against emergency out-of-band response unless Essbase is internet-exposed.

An attacker with network reachability to an exposed Oracle Essbase instance sends crafted TCP traffic to the Security component, and after satisfying the difficult-to-meet preconditions (reflected in the high attack complexity), chains the flaw into full control of the server. No credentials or user interaction are required, but the high complexity means reliable exploitation is non-trivial. No public proof-of-concept exploit is known at the time of analysis.