The vulnerability resides in the Build component of Oracle Essbase 21.8.3.0.0. A low‑privileged attacker with network access over HTTP can exploit this flaw, allowing the attacker to read any data that the Essbase application can access. The primary impact is the disclosure of sensitive data, with no indicated effect on integrity or availability.

Oracle Essbase version 21.8.3.0.0 is the only explicitly affected product; the advisory notes a scope change that may impact additional products, but no other specific versions are listed.

The advisory assigns a CVSS v3.1 base score of 7.7, indicating a moderate‑to‑high severity with high confidentiality impact. The vector shows that an attacker can act over the network with low complexity and low privilege, meaning the vulnerability is easily exploitable from any untrusted network. The EPSS score is reported as less than 1 %, suggesting a low‑but‑nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, but its ease of exploitation and confidentiality impact keep the overall risk significant for exposed Essbase servers.