{"cve":"CVE-2026-70689","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"generic","value":"21.8.1.0.0"}}],"enrichment":{"confidence":95.0,"confidence_source":"inferred","scores":[{"score":95.0,"source":"inferred"},{"score":100.0,"source":"matching"}]},"original":{"product":"Oracle Essbase","source":"cna","vendor":"Oracle Corporation"},"product":"essbase","vendor":"oracle"}],"created":"2026-08-19T01:30:05.333276+00:00","updated":"2026-08-24T22:15:13.811005+00:00","vendors":["oracle","oracle$PRODUCT$essbase"]},"epss":{"score":0.00508},"mitre":{"cpes":["cpe:2.3:a:oracle:essbase:21.8.1.0.0:*:*:*:*:*:*:*"],"created":"2026-08-18T21:01:01.643000+00:00","description":"Vulnerability in Oracle Essbase (component: Infrastructure).   The supported version that is affected is 21.8.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/70xxx/CVE-2026-70689.json","references":["https://www.oracle.com/security-alerts/cspuaug2026.html"],"title":null,"updated":"2026-08-25T03:57:09.048000+00:00","vendors":["oracle","oracle$PRODUCT$essbase"],"weaknesses":[]},"nvd":{"cpes":["cpe:2.3:a:oracle:essbase:21.8.1.0.0:*:*:*:*:*:*:*"],"created":"2026-08-18T21:17:20.887000+00:00","description":"Vulnerability in Oracle Essbase (component: Infrastructure).   The supported version that is affected is 21.8.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-70689.json","references":["https://www.oracle.com/security-alerts/cspuaug2026.html"],"title":null,"updated":"2026-09-03T17:05:30.660000+00:00","vendors":["oracle","oracle$PRODUCT$essbase"],"weaknesses":["CWE-284"]},"opencve":{"changes":[{"created":"2026-08-18T21:15:00+00:00","data":[{"details":{"new":"Vulnerability in Oracle Essbase (component: Infrastructure).   The supported version that is affected is 21.8.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","old":null},"type":"description"},{"details":["oracle","oracle$PRODUCT$essbase"],"type":"first_time"},{"details":{"added":["cpe:2.3:a:oracle:essbase:21.8.1.0.0:*:*:*:*:*:*:*"],"removed":[]},"type":"cpes"},{"details":{"added":["oracle","oracle$PRODUCT$essbase"],"removed":[]},"type":"vendors"},{"details":{"added":["https://www.oracle.com/security-alerts/cspuaug2026.html"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV3_1":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"80bb6ebf-947b-4929-bce5-869181a98efb"},{"created":"2026-08-19T01:45:00+00:00","data":[{"details":{"new":"Unauthenticated HTTP exploitation enables takeover of Oracle Essbase","old":null},"type":"title"},{"details":{"added":["CWE-284"],"removed":[]},"type":"weaknesses"}],"id":"3972034a-536f-4b1b-a2c0-daa7d7b6f9ea"},{"created":"2026-08-21T08:30:00+00:00","data":[{"details":{"new":null,"old":"Unauthenticated HTTP exploitation enables takeover of Oracle Essbase"},"type":"title"},{"details":{"added":[],"removed":["CWE-284"]},"type":"weaknesses"}],"id":"53b453ab-b21d-49eb-a392-2d5c8b1b0ec4"},{"created":"2026-08-21T10:15:00+00:00","data":[{"details":{"new":"HTTP Exploit Enables Full Takeover of Oracle Essbase 21.8.1.0.0","old":null},"type":"title"}],"id":"13d18bac-7f60-4099-b3b2-cf3bc581e30b"},{"created":"2026-08-24T20:30:00+00:00","data":[{"details":{"added":["CWE-284"],"removed":[]},"type":"weaknesses"},{"details":{"added":{"ssvc":{"options":{"Automatable":"yes","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"a52af2f7-983a-451b-a56e-84c5b614da21"},{"created":"2026-08-24T22:30:00+00:00","data":[{"details":{"new":null,"old":"HTTP Exploit Enables Full Takeover of Oracle Essbase 21.8.1.0.0"},"type":"title"}],"id":"35f24ceb-b74a-4cb2-a927-8e539d14bfb1"}],"cpes":{"data":["cpe:2.3:a:oracle:essbase:21.8.1.0.0:*:*:*:*:*:*:*"],"providers":["mitre","nvd"]},"created":{"data":"2026-08-18T21:01:01.643000+00:00","provider":"mitre"},"description":{"data":"Vulnerability in Oracle Essbase (component: Infrastructure).   The supported version that is affected is 21.8.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"provider":"mitre"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.00508},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"yes","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://www.oracle.com/security-alerts/cspuaug2026.html"],"providers":["mitre","nvd"]},"title":{"data":null,"provider":null},"updated":{"data":"2026-08-24T22:15:13.811005+00:00","provider":"enrichment"},"vendors":{"data":["oracle","oracle$PRODUCT$essbase"],"providers":["mitre","nvd","enrichment"]},"weaknesses":{"data":["CWE-284"],"providers":["nvd","vulnrichment"]}},"vulnrichment":{"cpes":[],"created":"2026-08-18T21:01:01.643000+00:00","description":"Vulnerability in Oracle Essbase (component: Infrastructure).   The supported version that is affected is 21.8.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"yes","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"}},"references":[],"title":null,"updated":"2026-08-24T19:50:41.458000+00:00","vendors":[],"vulnrichment_repo_path":"2026/70xxx/CVE-2026-70689.json","weaknesses":["CWE-284"]}}