EUVD-2026-106851
GHSA-wpx9-v646-58fg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Essbase over TCP network
-
ExploitSend crafted request to Security component
-
ExecutionTrigger hang or repeatable crash
-
ImpactComplete denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only TCP network reachability to an Oracle Essbase 21.8.3.0.0 instance's Security component - no authentication (PR:N), no user interaction (UI:N), and no special configuration are indicated by the vector or description, so default deployments reachable over the network are exploitable. The practical limiting factors are network exposure (Essbase is typically deployed in internal enterprise BI/EPM environments rather than internet-facing, reducing attacker reach) and version specificity (only 21.8.3.0.0 is cited as affected). Impact is confined to availability: a successful attack causes a hang or repeatable crash (complete DOS) but grants no data access or code execution. |
| Impact | This is a genuine but bounded availability-only risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: unauthenticated, network-reachable over TCP, low attack complexity, no user interaction, and impact limited strictly to availability (complete DOS via hang or repeatable crash) with zero confidentiality or integrity impact. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the 7.5 is driven entirely by ease of reach plus full availability loss, not by data compromise or code execution. SSVC-style framing: exploitation = none observed, technical impact = partial (availability only, no system takeover), automatable = likely yes given AV:N/AC:L/PR:N/UI:N. Net: prioritize patching on internet- or widely-exposed Essbase instances because the flaw is trivially triggerable pre-auth, but it ranks below any RCE or data-exposure CVE of similar score since the worst outcome is service disruption, not compromise. No signals conflict; the main gap is the absence of EPSS/KEV/POC data to gauge real-world exploitation likelihood. |
| Exploit ScenarioDerived | An unauthenticated attacker with TCP network access to an exposed Oracle Essbase 21.8.3.0.0 server sends crafted traffic to the Security component, causing the service to hang or repeatedly crash and taking Essbase offline for all legitimate users. No credentials, user interaction, or special privileges are required. No public proof-of-concept is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Oracle Essbase 21.8.3.0.0 can be hung or repeatedly crashed by unauthenticated remote attackers who can reach the Security component over TCP, producing a complete denial of service with no confidentiality or integrity impact. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), so no credentials or user interaction are required according to the supplied assessment. No public exploit identified at time of analysis, and no CISA KEV entry is present; exposure is highest for internet-reachable or broadly accessible Essbase deployments.
RemediationAI
Patch available per vendor advisory: apply the Oracle Critical Patch Update October 2026 fix for Oracle Essbase; the supplied data identifies patch availability through the advisory but does not specify an exact patched build, so confirm the fixed release at https://www.oracle.com/security-alerts/cpuoct2026.html before upgrading 21.8.3.0.0. Until patched, restrict TCP access to the Essbase Security component to trusted application and administration networks via firewall rules, security groups, or network segmentation, and monitor for hangs or repeated crashes; this can interrupt legitimate remote BI/EPM client connectivity, so maintain explicit allowlists and test business flows. If the Security service does not need external exposure, bind or expose it only on internal interfaces.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Essbase is an OLAP/EPM server, and the affected Security component handles authentication, authorization, and related network services. The supplied data does not assign a CWE, but the CVSS vector and description indicate a remotely triggerable availability flaw: AC:L, PR:N, UI:N, A:H, with no confidentiality or integrity impact. The attack surface is TCP reachability to the Security component in version 21.8.3.0.0; the root-cause flaw is not further detailed, so analysts should not infer code execution or data disclosure. The practical constraint is deployment topology: Essbase commonly sits in internal BI/EPM networks rather than being internet-facing, which reduces attacker reach.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network TCP reach with low complexity (AV:N/AC:L/PR:N/UI:N); impact is availability-only complete DOS, so C:N/I:N/A:H and scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Essbase. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Executive ViewAI
Oracle Essbase 21.8.3.0.0 is exposed to an unauthenticated network-based denial-of-service condition that can render the analytics platform unavailable or repeatedly unstable, disrupting business reporting and dependent processes. Leadership should prioritize because internet-reachable or broadly accessible deployments could be taken offline without credentials, though no data confidentiality or integrity loss is indicated.
Restrict TCP access to the Essbase Security component to trusted networks and users, segment internet-reachable deployments behind firewalls or VPNs, apply rate limiting and network monitoring for crash or hang patterns, maintain offline backups and failover capacity, and engage Oracle support for interim guidance until a vendor patch is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB