EUVD-2026-61644
GHSA-998x-p9h7-3r93
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Essbase HTTP interface over network
-
DeliverySend crafted unauthenticated request
-
ExploitExploit Infrastructure component flaw
-
ExecutionGain full control of instance
-
ImpactCompromise confidentiality, integrity and availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against Oracle Essbase 21.8.1.0.0 (AV:N/AC:L/PR:N/UI:N). The only prerequisite is network reachability of the Essbase HTTP/application interface; no authentication, no user interaction, and no non-default configuration are required per Oracle's description and CVSS vector. The practical limiting factors are therefore purely exposure-based: the vulnerable HTTP service must be network-accessible to the attacker, so deployments where Essbase is isolated on an internal-only or VPN-gated management segment materially reduce the realistic attack surface. The specific vulnerable feature, endpoint, or protocol detail within the Infrastructure component is not disclosed by Oracle. |
| Impact | All available severity signals point the same direction: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields a base score of 9.8, indicating remote, unauthenticated, low-complexity exploitation with total compromise of confidentiality, integrity, and availability. Oracle's own language ('easily exploitable,' 'unauthenticated attacker with network access,' 'takeover') reinforces the vector rather than conflicting with it. However, softer signals are absent: no EPSS score was provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no POC or SSVC decision data accompanies the input - so exploitation likelihood cannot be quantified beyond the intrinsic ease Oracle describes. The net picture is a genuine high priority driven by unauthenticated network takeover potential, tempered by the fact that real-world exploitation evidence (KEV/EPSS/POC) is currently unknown rather than confirmed. |
| Exploit ScenarioDerived | An attacker who can reach the Essbase HTTP interface over the network sends a crafted request to the vulnerable Infrastructure component and, without any credentials or user interaction, gains full control of the Essbase instance and its underlying analytical data. Because Oracle rates it 'easily exploitable' with low attack complexity, a single unauthenticated request could suffice; no public POC is identified at time of analysis, so exploitation would currently require independent development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Complete takeover of Oracle Essbase 21.8.1.0.0 is possible by an unauthenticated remote attacker over HTTP, per Oracle's August 2026 Critical Patch Update. Oracle rates it CVSS 9.8 with full confidentiality, integrity, and availability impact and flags it as 'easily exploitable,' meaning no authentication, no user interaction, and low attack complexity are required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of network reach and unauthenticated takeover makes it a high-priority patch candidate.
RemediationAI
Apply the fixes from Oracle's August 2026 Critical Patch Update as the primary remediation: Patch available per vendor advisory at https://www.oracle.com/security-alerts/cspuaug2026.html - Oracle CPUs are cumulative, so install the latest quarterly patch for Essbase 21.8.1.0.0 (Oracle did not publish a discrete fixed version string in this input, so consult the CPU matrix for the exact patch level). Until patching is complete, reduce exposure by restricting network access to the Essbase HTTP/management interfaces to trusted management networks or VPN only, placing the server behind a reverse proxy or WAF, and blocking direct internet exposure of the Essbase ports; the trade-off is that legitimate remote analytics clients and integrations may lose direct connectivity and require routing through the allowed segments. Because Oracle does not disclose the vulnerable endpoint or a feature toggle, no targeted feature-disable workaround can be recommended, making network isolation the main compensating control pending the patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Essbase is a multidimensional OLAP (online analytical processing) engine used for enterprise business analytics, planning, budgeting, and forecasting; it is typically fronted by an HTTP/application-server tier that exposes management and query interfaces. The flaw resides in the 'Infrastructure' subcomponent, which handles the platform's core service and web-facing plumbing rather than a specific analytics feature. Oracle does not assign a CWE (CWE: N/A) for this entry, so the precise root-cause class (e.g., authentication bypass, injection, or deserialization) is not disclosed; the CVSS vector's network-attack, no-privilege profile combined with 'takeover' impact is consistent with an authentication/authorization weakness or a remotely reachable code-execution defect in the HTTP-facing infrastructure layer.
Know when Essbase gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle describes unauthenticated network HTTP exploitation with low complexity and full takeover, so AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H are all warranted.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in Oracle Essbase (component: Infrastructure). The supported version that is affected is 21.8.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Essbase 21.8.1.0.0 is vulnerable to unauthenticated remote system takeover via HTTP, exposing organizations to immediate risk of data theft, service disruption, and operational compromise with no vendor patch currently available. Any internet-connected or untrusted-network-facing Essbase deployment can be fully compromised by an attacker without credentials or user interaction.
No vendor-released patch identified at time of analysis. Implement: (1) network segmentation and strict firewall rules limiting access to Essbase systems to authorized administrative networks only; (2) Web Application Firewall deployment with CVE-2026-70689 detection rules; (3) comprehensive logging, monitoring, and alerting for inbound connection attempts and exploitation indicators; (4) regular vulnerability scanning to detect unauthorized access; (5) evaluate decommissioning Essbase 21.8.1.0.0 or requiring air-gapped/isolated network deployment if business continuity permits.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verificatio
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcar
This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. Rat
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Acto
Oracle Essbase 21.8.3.0.0 (Security component) permits a low-privileged authenticated user to take full control of the E
Authenticated low-privileged attackers with network access to Oracle Essbase 21.8.3.0.0's T3/IIOP listeners can achieve
Remote takeover of Oracle Essbase 21.8.3.0.0 is possible for low-privileged authenticated attackers with HTTP network ac
Oracle Essbase 21.8.3.0.0 contains an easily exploitable flaw in its Security component that lets a low-privileged, netw
Exploit-DB