Oracle Essbase contains a vulnerability in its Security component that can be triggered by an attacker with low privileges who can reach the system over HTTP. When successfully exploited, the attacker can read a subset of data that is normally protected by Essbase's access controls. This vulnerability is a CWE-200 information disclosure flaw, allowing unauthorized read access to sensitive data. The compromise does not grant code execution or broader system control, but it allows the disclosure of sensitive information within the database. The CVSS v3.1 score of 5.0 reflects that the primary impact is on confidentiality through unauthorized read access.

The affected product is Oracle Essbase version 21.8.3.0.0. Other versions are not listed as affected unless Oracle issues an update. The vulnerability specifically targets the Security component and could potentially propagate to other products that rely on Essbase for data. Administrators should verify whether any other components depend on Essbase and assess whether they are indirectly exposed.

Because the flaw is exploitable over the network via HTTP and does not require elevated privileges, the likelihood of successful attacks by low‑privileged users is very low. The CVSS base score of 5.0 indicates a medium severity. EPSS indicates a very low exploitation probability (<1%), and the vulnerability is not listed in CISA KEV, suggesting no publicly known active exploitation. Nevertheless, given the network exposure, a recent security advisory from Oracle recommends monitoring for anomalous read activity and applying future patches when available.