An exploitable weakness in Oracle Essbase enables a low‑privileged attacker with network access via HTTP to compromise data confidentiality. The vulnerability allows the attacker to gain unauthorized access to critical data or potentially all data exposed by Essbase, resulting in a high confidentiality impact as reflected in the CVSS vector.

Oracle Corporation’s Oracle Essbase product, specifically version 21.8.3.0.0, is susceptible to this flaw.

The CVSS base score of 7.7 indicates a moderate to high severity, with the vector specifying a network attack that requires low privileges and no user interaction. Though an EPSS score is available (indicating a very low probability of exploitation), the vector suggests the vulnerability can be leveraged by a low‑privileged attacker adjacent to the network. The flaw is not yet listed in the CISA KEV catalog, but the description indicates a scope change that could affect related products.