The vulnerability lies in the Java Based Agent component of Oracle Essbase 21.8.3.0.0. An unauthenticated attacker who can reach the exposed HTTP interface may read a subset of data that is meant to be protected. The confidential information exposed is limited to a portion of the Essbase data store, while integrity and availability remain unaffected. Based on the description, the impact is a partial breach of confidentiality only.

Oracle Essbase version 21.8.3.0.0 is the sole variant identified as vulnerable. There are no other affected releases listed, and the vulnerability specifically targets the Java Based Agent component of this product.

The CVSS base score of 3.7 reflects a low‑severity confidentiality impact; the EPSS score of less than 1% indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers must gain network access to the HTTP port of the Java Based Agent, which is typically confined to an internal network; this requirement, coupled with the high attack complexity shown in the vector, suggests that practical exploitation is limited. The likely attack vector is an unauthenticated HTTP request sent to the exposed interface, as inferred from the description and the CVSS vector of AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.