Oracle Essbase CVE-2026-91663

Exploitation requires network reachability to the Oracle Essbase T3 and/or IIOP listener (the WebLogic remote-invocation ports) AND a low-privileged authenticated account on the target (CVSS PR:L), so this is NOT exploitable by a fully unauthenticated attacker against default-closed configurations. The primary limiting factor is exposure of the T3/IIOP management protocols - environments that firewall or disable these ports, or restrict them to trusted management networks, substantially reduce reachability. The affected supported version is Oracle Essbase 21.8.3.0.0. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once protocol access and a low-privileged credential are obtained, exploitation is reliable. The scope change (S:C) means successful exploitation can affect products beyond Essbase itself.

This is a genuine high-priority vulnerability, not a high-CVSS/low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 9.9) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with a scope change and full confidentiality/integrity/availability impact culminating in complete takeover of Oracle Essbase. The scope change (S:C) combined with Oracle's own statement that 'attacks may significantly impact additional products' means compromise is not contained to Essbase, which materially raises priority. Attack surface is the T3 and IIOP protocols - the WebLogic/RMI management channels Essbase runs on - which are frequently exposed internally and sometimes externally. Key risk-amplifying signals are PARTLY MISSING: no EPSS score, no CISA KEV listing, and no POC were provided in the input, so exploitation likelihood cannot be quantified. Exploitation status is therefore 'no public exploit identified at time of analysis.' Note the single reference is Oracle's quarterly Critical Patch Update (cpuoct2026.html), so this was disclosed and patched as part of routine Oracle CPU hardening rather than in response to observed in-the-wild attacks. Treat as high priority for patching given the trivial complexity and takeover impact, while recognizing that active-exploitation evidence is absent, not confirmed.

An attacker with a low-privileged account reachable over the network sends crafted requests to the Essbase server's T3 or IIOP listener, abusing a flaw in the Security component to escalate to full control. Because the vulnerability has low attack complexity and no user interaction, a single authenticated session on an exposed management port is sufficient to take over the server and, via the scope change, pivot into connected products. No public proof-of-concept was identified in the provided data.