Oracle Essbase CVE-2026-91663: Critical RCE via T3/IIOP Allows Full Control

Oracle Essbase contains a critical security vulnerability in its Security component that permits remote takeover. The flaw is present in version 21.8.3.0.0 and can be exploited over the network. Attackers do not need high-level credentials to initiate the compromise. The National Vulnerability Database classifies this as easily exploitable. This exposure allows unauthorised control of the application.

Root cause

The vulnerability resides within the Security component of Oracle Essbase. The National Vulnerability Database record for CVE-2026-91663 identifies the issue but does not detail specific coding errors. The flaw enables a low-privileged attacker to bypass normal restrictions. It is classified as a security weakness in the software. No further technical details about the underlying code logic are provided in the source material.

Attack path

An attacker needs network access to the vulnerable Oracle Essbase instance. They must possess low-privileged credentials to initiate the attack. The exploitation occurs via the T3 or IIOP protocols. Successful exploitation results in the complete takeover of Oracle Essbase. The National Vulnerability Database states the vulnerability is easily exploitable. Scope change means additional products may also be significantly impacted by the attack.

Affected versions

• Oracle Essbase 21.8.3.0.0 is the only supported version confirmed to be affected.
• No other versions are listed in the National Vulnerability Database record.
• The impact is confined to this specific release according to the source material.

Mitigation

• Verify if your environment runs Oracle Essbase version 21.8.3.0.0.
• Restrict network access to T3 and IIOP ports for this application.
• Review low-privileged account permissions and monitor for unusual activity.
• Await official vendor guidance or patches for CVE-2026-91663.

Signals worth monitoring

Security operations teams should examine logs for unexpected T3 or IIOP traffic from low-privileged accounts. Look for sudden changes in application state or configuration that indicate a takeover. Monitor for authentication successes followed immediately by high-impact actions. Check if the scope of affected systems expands beyond the initial Essbase instance. Validate that network segmentation is enforcing strict access controls. Investigate any anomalies in the Security component logs promptly.

What to do and how to stay safe: Oracle

• Audit network configurations to block unnecessary T3 and IIOP traffic from untrusted zones.
• Implement strict least-privilege access controls for all Essbase user accounts.
• Enable detailed logging for authentication and administrative actions within the application.
• Isolate affected instances from critical network segments until a fix is available.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-91663?

The CVSS 3.1 Base Score is 9.9, which is rated as Critical.

Which Oracle Essbase version is affected?

Only version 21.8.3.0.0 is listed as affected in the source material.

What protocols are used to exploit this vulnerability?

Attackers can exploit the flaw via the T3 or IIOP protocols over the network.