The vulnerability resides in the Security component of Oracle Essbase version 21.8.3.0.0, allowing an unauthenticated or low‑privileged attacker with network access via HTTP to trigger a partial denial of service. Attackers can issue requests that consume resources, leading to intermittent unavailability without affecting confidentiality or integrity, as reflected by a CVSS score of 4.3 and an availability‑only impact.

Oracle Essbase 21.8.3.0.0 is the sole product and version affected. No other variants are listed in the CVE data.

With a CVSS score of 4.3 the vulnerability presents a moderate threat to service availability. The EPSS score of less than 1% indicates a low probability of exploitation in the current environment, and the issue is not listed in the CISA KEV catalog. Attackers can leverage a network‑based HTTP connection to send crafted requests that consume server resources, causing intermittent outages unless mitigated through patching, IP filtering, or monitoring.