The Oracle OLAP component contains a vulnerability that allows an attacker with only the DBMS_AW privilege to compromise the system over Oracle Net. The flaw can be exploited from the network, requires low attack complexity, and needs only low privilege, enabling the attacker to gain full control of Oracle OLAP. Successful exploitation results in loss of confidentiality, integrity and availability, effectively allowing complete takeover of the component.

Installed on Oracle Database Server for Oracle OLAP. Versions 19.3 through 19.32, 21.3 through 21.23, and 23.4.0 through 23.26.3 are affected. The vulnerability is reachable via Oracle Net when the attacker can connect to the database from a remote host.

The CVSS 3.1 base score of 8.8 indicates a high severity. The EPSS score is <1%, indicating a low but non‑zero probability of exploitation, and the flaw is not listed in the CISA KEV catalog. The remote nature of the exploit and the requirement for only a low‑privilege DBMS_AW role make it feasible for attackers to leverage it in the wild. Once exploited, an attacker can fully control the Oracle OLAP service, posing a critical threat to data and infrastructure.