The vulnerability is a remote code execution flaw in Oracle Essbase that allows an attacker with low privileges and network connectivity via T3 or IIOP to take full control of the database server. Successful exploitation can lead to a complete takeover, leaking confidential data, manipulating the integrity of stored information, and disabling service availability. The CVSS 3.1 score of 9.9 reflects the severe confidentiality, integrity and availability impact associated with this flaw.

This issue affects Oracle Corporation’s Essbase product version 21.8.3.0.0. No other products or versions are listed as vulnerable in the data.

The extraordinary CVSS score indicates a top-tier risk, and the EPSS score of < 1% indicates a very low but non-zero exploitation probability, leaving the actual frequency uncertain but not dismissible. The flaw is exploitable over the network through T3 or IIOP channels by an attacker with only low-level credentials, and the scope change allows the vulnerability to elevate privileges and affect higher-level components. The vulnerability is not listed in CISA’s KEV catalog, implying no confirmed exploited instances have yet been reported. Nevertheless, given the high severity and potential for complete system compromise, organizations running the impacted Essbase version should treat this flaw as critical.