This vulnerability exists in the Java Based Agent component of Oracle Essbase and allows a high‑privileged attacker who already has logon access to the infrastructure where Essbase runs to compromise the application. The flaw can be exploited easily from a privileged local position and grants the attacker unauthorized access to all data exposed by Essbase. The impact is a confidentiality breach, potentially with a scope change that may affect additional Oracle products.

Oracle Essbase version 21.8.3.0.0 is affected. Only this version from Oracle Corporation is listed as impacted.

The CVSS v3.1 base score of 6.0 indicates a moderate severity with local attack vector (AV:L), low authentication effort (AC:L), and high privilege required (PR:H). Once the flaw is exploited, the attacker can read all Essbase data and potentially affect other Oracle products due to scope change. The EPSS score is less than 1 %, showing a very low but non‑zero probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Even though the risk is moderate, any environment where local privileged access is possible should apply the fix promptly.