Oracle Essbase version 21.8.3.0.0 contains a security flaw that lets a low‑privileged attacker with network access via HTTP compromise the system. The vulnerability is easily exploitable and provides full takeover, leading to loss of confidentiality, integrity, and availability. The CVSS v3.1 score of 9.9 reflects the high impact and the changed scope, indicating that the compromise can extend beyond the target application to related products.

Affected product: Oracle Essbase, version 21.8.3.0.0 as listed by Oracle. No other vendor or product versions are known to be impacted.

The CVSS base score of 9.9 signals a critical risk. EPSS data is not available, but the lack of inclusion in the CISA KEV catalog does not lower the risk; the scope change and remote network attack vector (HTTP) mean that an attacker only needs network-level access to launch the exploit. Organizations should treat this as a high‑priority vulnerability awaiting vendor mitigation.