This vulnerability in Oracle Essbase’s security component allows a low‑privileged attacker with network access over HTTP to gain unauthorized access to critical data, modify or delete entries, and trigger a partial denial of service. The impact spans confidentiality (high), integrity (low) and availability (low), as reflected in the CVSS 3.1 base score of 9.1. Attackers can read, insert, delete, and alter records, potentially compromising entire Essbase data sets. The flaw is trivially exploitable because only low privilege credentials are required, and no user interaction is necessary.

Oracle Essbase version 21.8.3.0.0 is affected. The vulnerability may affect other products that interact with Essbase due to the scope change, but the primary impact is on the Essbase instance listed.

The CVSS score indicates high severity and the vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) confirms a network‑based attack with low effort. The EPSS score of < 1% indicates a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack path is a remote attacker sending crafted HTTP requests to the Essbase server to exploit a privilege‑validation flaw in the security component. Because the flaw allows unauthorized data access and partial denial of service, it represents a significant risk to organizations running the affected version.