The vulnerability in Oracle Essbase allows an attacker with low privileges and network access through HTTP to compromise the system. An exploitable flaw in the Security component can lead to the disclosure or full access to all data that the Essbase instance serves. The weakness corresponds to an improper access control issue that grants unauthorized users confidentiality impact, as indicated by the CVSS vector.

Oracle Essbase version 21.8.3.0.0 is affected. No other versions are listed. The product is delivered by Oracle Corporation.

The CVSS v3.1 base score is 7.7, reflecting a high severity with confidentiality impact and a scope change. The EPSS score is less than 1%, indicating a very low but nonzero likelihood of exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed exploitation yet. The likely attack vector is network based via HTTP due to the stated requirement for network access; a low‑privileged attacker can exploit the flaw to read protected data, but requires connectivity to the Essbase HTTP interface.