A weakness in the security component of Oracle Essbase version 21.8.3.0.0 allows an unauthenticated attacker with TCP network access to take complete control of the Essbase instance. Successful exploitation can result in a full takeover, compromising confidentiality, integrity, and availability of all data processed by Essbase. The vulnerability is defined by the CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting the high impact across all core security attributes.

Oracle Essbase, released by Oracle Corporation, with the affected build 21.8.3.0.0. This advisory applies to deployments of that build.

The CVSS score of 8.1 places the flaw in the high severity range. The EPSS score of < 1% indicates a very low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog, so the likelihood of a widespread attack is uncertain, but the potential impact remains severe. The attack vector is a remote unauthenticated TCP connection, as stated in the description, meaning that any external host able to reach the Essbase service could attempt the exploit without prior authentication.