A flaw in the Security component of Oracle Essbase allows an unauthenticated attacker with network access via T3 or IIOP to read a subset of otherwise protected data. The vulnerability is reflected in a CVSS 3.1 base score of 5.3, indicating a low‑to‑moderate impact on confidentiality while integrity and availability remain unaffected. The weakness is classified as CWE‑200: Information Exposure.

Oracle Essbase version 21.8.3.0.0 is the only version recorded as impacted in the current advisory. All other releases with the applicable fix are considered unaffected.

The attack requires no authentication and can be launched from any host that can reach the T3 or IIOP interfaces, making it easily exploitable for compromised or openly reachable environments. The EPSS score of < 1% signals a very low current exploitation probability, though the vulnerability is still present. It is not listed in the CISA KEV catalog, indicating no widespread exploitation has been reported. Nevertheless, an attacker who can reach the target can gain unintended read access to sensitive business data, potentially triggering regulatory or business risks.