EUVD-2026-106847
GHSA-gmwx-w47p-wjh2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged Essbase credentials
-
ExploitSend crafted HTTP request to Essbase service
-
ExecutionTrigger resource/handling fault in Security component
-
ImpactCause partial denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privileged account on Oracle Essbase (CVSS PR:L), reachable over the network via HTTP. It affects Oracle Essbase version 21.8.3.0.0 in the Security component. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the mandatory authentication is the key limiting factor, and impact is confined to a partial denial of service (A:L) - no data disclosure or modification is possible. The description names no special non-default feature or configuration beyond a running, network-exposed Essbase instance. |
| Impact | This is a moderate-severity, low-priority issue despite being network-reachable. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, base 4.3) confirms a network-accessible, low-complexity flaw requiring low privileges (PR:L - an authenticated account) with impact limited to a partial availability loss (A:L) and no confidentiality or integrity impact. No EPSS score is provided in the input, there is no CISA KEV listing, and no public exploit code is referenced - the only source is Oracle's October 2026 Critical Patch Update advisory. The signals are internally consistent rather than conflicting: a low-severity DoS-only flaw requiring prior authentication is exactly the kind of high-noise/low-urgency issue that should be patched on the normal Oracle CPU cadence rather than emergency-patched. The main caveat is missing exploitation telemetry: because no EPSS or POC data accompanies this record, real-world exploitation likelihood cannot be quantified, but the requirement for valid credentials and the availability-only impact strongly limit its attractiveness to attackers. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged Essbase account sends crafted HTTP requests to the Essbase service to trigger a condition that degrades or partially interrupts service availability. No public exploit code is identified at time of analysis, and because the impact is only a partial denial of service, the result is reduced availability rather than data compromise or code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Oracle Essbase 21.8.3.0.0 contains a Security-component flaw that allows an authenticated low-privileged user with HTTP network access to cause a partial denial of service. The CVSS 3.1 score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), so only availability is lightly affected and no confidentiality or integrity impact is possible; the required account is the main limiting factor. No public exploit code was identified at time of analysis, and no CISA KEV entry is present.
RemediationAI
Apply the Oracle Critical Patch Update referenced at https://www.oracle.com/security-alerts/cpuoct2026.html for Oracle Essbase 21.8.3.0.0; patch status is 'Patch available per vendor advisory,' but the input does not list a separate fixed version string, so confirm the exact target release in the advisory before upgrading. Until patched, reduce exposure by restricting HTTP access to Essbase with network ACLs or firewall rules to trusted clients, and review and limit low-privileged accounts that can reach the service; these controls trade off legitimate remote access and may require client reconfiguration. Monitor for unusual availability degradation or repeated requests from authenticated users.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Essbase is an OLAP and multidimensional analytics server; the affected Security component is reachable over HTTP. The CVSS vector describes a network-reachable, low-complexity attack that requires a valid low-privileged account (PR:L) and no user interaction, with impact limited to low availability (A:L) and no confidentiality or integrity effect. The root-cause class is not identified because no CWE was supplied, and no CPE string was provided to narrow the platform footprint beyond Oracle Essbase 21.8.3.0.0. Exploitation depends on a running, network-exposed Essbase instance and valid credentials, not on an unauthenticated path.
Know when Essbase gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Network HTTP vector with low complexity; requires a low-privileged authenticated account (PR:L) and yields only partial availability loss, so C/I are N and A:L.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verificatio
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcar
This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. Rat
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Acto
Oracle Essbase 21.8.3.0.0 (Security component) permits a low-privileged authenticated user to take full control of the E
Authenticated low-privileged attackers with network access to Oracle Essbase 21.8.3.0.0's T3/IIOP listeners can achieve
Remote takeover of Oracle Essbase 21.8.3.0.0 is possible for low-privileged authenticated attackers with HTTP network ac
Oracle Essbase 21.8.3.0.0 contains an easily exploitable flaw in its Security component that lets a low-privileged, netw
Exploit-DB