Oracle Essbase CVE-2025-61763

Exploitation requires network HTTP access to the Oracle Essbase Web Platform and an authenticated session as a low-privileged Essbase user (PR:L) - it is not exploitable by a fully unauthenticated attacker despite the input tag. The affected target is specifically Oracle Essbase version 21.7.3.0.0; no user interaction is needed (UI:N) and no non-default feature toggle is named in the advisory. Limiting factors: the attacker must already hold valid low-privilege credentials or an account on the Essbase instance, and the Web Platform component must be network-exposed; impact is confined to Essbase-accessible data (confidentiality and integrity) with no availability/denial-of-service effect.

This is a genuinely serious but not emergency-tier vulnerability, and the signals are largely consistent. The Oracle-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication (PR:L) and no user interaction, yielding high confidentiality and integrity impact but no availability impact. Against that, the exploitation-likelihood signals are modest: EPSS is only 0.27% (18th percentile), there is no CISA KEV listing, and no public proof-of-concept is identified, so there is no evidence of active or imminent mass exploitation. The one notable conflict is the input 'Authentication Bypass' tag, which contradicts the CVSS vector's PR:L (an authenticated low-privileged attacker is required, not an unauthenticated bypass) and the CWE-284 (Improper Access Control) classification - this looks like an authorization/access-control flaw abusable by an existing low-privileged user, not a true pre-auth bypass; verify with Oracle. Net: a real priority for organizations running the affected Essbase version (high C/I impact, easy to exploit once a foothold exists), but the low EPSS and absence of KEV/POC mean this is a patch-in-normal-cycle item rather than a drop-everything emergency.

A low-privileged authenticated user of the Oracle Essbase Web Platform sends crafted HTTP requests that abuse improper access controls to reach data or operations outside their authorization. No public exploit code is identified at this time, so exploitation would require an attacker to develop their own technique, but the low attack complexity (AC:L) means a working method is likely straightforward once the flaw is understood.