The vulnerability resides in the security component of Oracle Essbase and permits a low‑privileged attacker with network access via HTTP to gain unauthorized read access to all data accessible through Essbase. A successful exploitation can lead to confidential data disclosure, while the attack vector requires no user interaction. The weakness is characterized by an authentication or authorization bypass, which grants information that otherwise would be protected.

The affected product is Oracle Essbase version 21.8.3.0.0, released by Oracle Corporation. This version is explicitly listed as vulnerable in the vendor’s security alert. Only this version is known to be impacted; all other versions are not documented as affected in the available advisory.

The CVSS v3.1 base score of 7.7 indicates moderate to high severity, with confidentiality impact scored high. Because the exploit is described as easily exploitable, a low‑privileged attacker who can reach the HTTP interface has a realistic chance of success. The EPSS score of <1% indicates a very low but non‑zero probability of exploitation, yet the presence of a dedicated security alert suggests that the issue may already be actively targeted in the wild. Since the vulnerability has an impact scope change, additional products that rely on Essbase may also be at risk.