On Oracle Essbase, a flaw in the security component allows remote attackers who can reach the system over HTTP with low privileges to compromise the application. The vulnerability enables unauthorized update, insert, or delete operations on accessible data, as well as unauthorized read of a subset of data and the ability to trigger a partial denial of service. This identifies an access‑control weakness that can be exploited over the network.

Oracle Essbase, version 21.8.3.0.0, as supplied by Oracle Corporation.

The vulnerability carries a CVSS 3.1 score of 6.3, indicating medium severity, and an EPSS score of < 1%, indicating a very low likelihood of exploitation in the real world. It is not listed in the CISA KEV catalog. Because the flaw is reachable through a standard HTTP endpoint and does not require high‑privileged access, an attacker could perform the exploit from any network location that can reach the Essbase server. The impact and exploitation potential are moderate, with the ability to execute these actions without elevated privileges raising the risk for attackers that have compromised adjacent systems or have public network exposure.