Vulnerability in Oracle Essbase 21.8.3.0.0 allows an unauthenticated attacker with HTTP network access to arbitrarily update, insert, or delete accessible data, read a protected subset of information, or trigger a partial denial of service. This flaw resides in the security component of the application. The classification under access control and authentication weaknesses is inferred rather than explicitly stated. An attacker exploiting this weakness can compromise data confidentiality, integrity, and partially degrade availability, as indicated by the CVSS 3.1 score of 7.3.

Oracle Corp’s Essbase product, specifically version 21.8.3.0.0, is vulnerable.

The flaw allows unauthenticated remote exploitation over HTTP. Despite the low EPSS value, the impact on confidentiality, integrity, and availability is substantial, and the CVSS score of 7.3 underscores the severity. The vulnerability is not recorded in CISA KEV, but an attacker could still inflict data loss, unauthorized data manipulation, or temporary service disruption if the exposed HTTP interfaces are reachable.