A flaw in the Security component of Oracle Essbase enables an attacker with network access to the web interface to read a subset of accessible data without authentication. The vulnerability requires only that the attacker can reach the HTTP port and can send crafted requests; no credentials or user interaction are needed, making the attack straightforward once the target is reachable.

Oracle Essbase version 21.8.3.0.0 is the only release noted by Oracle as affected. All instances of this product that include the Security component are vulnerable, regardless of deployment size or environment.

The CVSS v3.1 base score of 5.3 indicates medium severity with a low confidentiality impact. An EPSS score of < 1% signals a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers would typically send a crafted HTTP request from outside the network to an exposed Essbase web endpoint; because no credentials are required, any host with open HTTP access to Essbase could be targeted.