Oracle Essbase CVE-2026-91665

No special conditions beyond network reachability - remote unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N) against Oracle Essbase 21.8.3.0.0 via its TCP-exposed Security component, per Oracle's description of an 'easily exploitable' flaw. The primary limiting factor is network exposure: the Essbase service/port must be reachable by the attacker, so instances restricted to internal segments, behind firewalls, or not internet-facing reduce realistic exposure. Exploitation is version-specific (confirmed affected: 21.8.3.0.0); other versions' status is not stated in the input.

All vendor-provided signals point to high real-world risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity exploitation requiring no privileges and no user interaction, yielding full confidentiality, integrity, and availability compromise (C:H/I:H/A:H, base 9.8) - and Oracle's own description explicitly states 'easily exploitable' resulting in 'takeover of Oracle Essbase,' which is consistent with the vector. However, several corroborating signals that would elevate operational urgency are absent: no EPSS exploitation-probability score is provided, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so this is 'no public exploit identified at time of analysis' rather than confirmed active exploitation. The result is a genuine high-priority patch candidate on severity and exploitability grounds, but with no evidence yet of in-the-wild or mass exploitation - the 9.8 reflects worst-case impact, not demonstrated attacker activity. Note a tagging discrepancy: the input is tagged 'Information Disclosure,' yet the description and vector indicate full system takeover (all three impacts High), so the category tag understates the actual impact - treat it as a full-compromise issue, not merely disclosure.

A remote, unauthenticated attacker with network reachability to the Essbase service sends crafted traffic over TCP to the vulnerable Security component of Oracle Essbase 21.8.3.0.0. Because no authentication, user interaction, or special preconditions are required and complexity is low, a single successful request chain leads to complete takeover of the Essbase instance. No public exploit code is referenced at time of analysis, so this scenario is based on the vendor's CVSS vector and 'takeover' description rather than an observed exploit.