The flaw resides in the security component of Oracle Essbase version 21.8.3.0.0. It is identified as a CWE-284 weakness. An attacker who can gain local high‑privilege access to the host running Essbase can exploit the vulnerability to compromise the instance, subsequently obtaining unauthorized access to the data that the application can read. The impact is limited to confidentiality; no integrity or availability effects are documented. The CVSS vector indicates that the attack requires local access, a high privilege level, and no user interaction.

Oracle Essbase version 21.8.3.0.0 produced by Oracle Corporation is affected. The advisory notes a scope change, meaning that exploitation may also influence other products or components that integrate with the Essbase server. No other versions or product variants are listed as affected.

The CVSS v3.1 base score of 6.0 classifies the issue as moderate severity. Exploitation requires local, high‑privileged access and does not involve any remote or user‑interaction pathways, making remote exploitation unlikely. The EPSS score of less than 1% indicates a very low probability of real‑world exploitation at this time, and the vulnerability is not currently listed in the CISA KEV catalog. Consequently, the greatest risk lies with internal attackers or compromised accounts that can obtain administrative privileges on the Essbase host. Regular monitoring for unusual administrative activity is recommended.