A vulnerability in the security component of Oracle Essbase allows an attacker with low privileges who can reach the system over HTTP to compromise the application. The flaw enables the attacker to execute arbitrary code on the server, providing full control of the Essbase instance and potentially affecting connected products. The impact is total compromise of confidentiality, integrity, and availability, as the attacker can read, modify, or delete any data and disable services.

Oracle Essbase 21.8.3.0.0 is the affected product; the vulnerability is specific to this release of the ESSBASE software, which is distributed by Oracle Corporation.

The CVSS base score of 9.9 signals a critical threat; the attack vector is network (HTTP) and requires only low privilege, while no user interaction is needed. EPSS is currently unavailable, and the issue is not listed in CISA KEV, though the high severity and low effort required suggest a high probability of exploitation in the wild. Successful exploitation would give the attacker full server takeover and allow further attacks on associated applications due to the scope change described in the advisory.