The flaw in Oracle Essbase allows a high‑privileged attacker with network access via HTTP to compromise the system. The vulnerability is easily exploitable and can be leveraged to gain unauthorized access to critical data or complete access to all Essbase data. The CVSS score of 6.8 indicates a moderate‑to‑considerable risk, primarily to confidentiality, with a change in scope allowing additional products to be affected if the attack is successful.

Vendors: Oracle; Product: Oracle Essbase; Affected version: 21.8.3.0.0. No other affected versions are specified.

The CVSS base score of 6.8 reflects a moderate severity, while the EPSS score of < 1% and absence from the CISA KEV catalog suggest that the vulnerability is not widely exploited at present. The required conditions include network connectivity to the HTTP interface of Essbase and possession of high‑privilege credentials. Successful exploitation would result in confidentiality compromise with no direct impact on integrity or availability according to the provided information.