Oracle Essbase 21.8.3.0.0 includes a security component flaw that allows a low‑privileged attacker with network access to read a subset of data exposed through the HTTP interface. The vulnerability is easily exploitable and can lead to unauthorized disclosure of confidential information because the attacker does not need to authenticate or has only minimal privileges. This flaw directly compromises the confidentiality of data handled by Essbase.

The affected product is Oracle Essbase version 21.8.3.0.0, which is the only version explicitly listed as vulnerable in the CNA advisory. No other vendors or products are mentioned as affected.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) yields a 5.0 base score, indicating moderate severity with a changed scope. The EPSS score is below 1%, indicating a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that targeted exploitation is not documented yet. However, the low privileged network attack vector and the scope change mean a network‑connected attacker could gain read access to sensitive data if the exposed HTTP service is reachable.