A vulnerability in the Security component of Oracle Essbase allows a low‑privileged attacker with network access over HTTP to compromise the application. The weakness can be exploited easily, giving the attacker full control of Essbase, affecting confidentiality, integrity, and availability. The impact is equivalent to an attacker taking over the Essbase instance.

The affected product is Oracle Essbase, version 21.8.3.0.0, which is the only supported release identified as vulnerable.

The CVSS v3.1 score is 9.9, indicating critical risk, with remote access over a low‑authentication channel and a single‑side scope change. EPSS score is less than 1%, indicating a very low but non‑zero probability of exploitation, and the vulnerability is not yet listed in CISA KEV. The likely attack vector is an attacker with network connectivity using HTTP, exploiting the vulnerability to gain takeover of Essbase. The high CVSS score and ease of exploitation mean that active exploitation is a realistic threat if the issue remains unpatched.