EUVD-2026-106832
GHSA-35wg-g87f-6qwx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Essbase HTTP endpoint
-
ExploitSend crafted request to Security component
-
ImpactRead subset of accessible Essbase data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network HTTP access to an Oracle Essbase 21.8.3.0.0 instance's Security component; per CVSS PR:N/UI:N it needs no authentication and no user interaction against the affected version. The primary limiting factors are network exposure (the Essbase HTTP service must be reachable by the attacker, so internal-only or firewalled deployments are less exposed) and the specific affected release 21.8.3.0.0; impact is further limited to read access to only a subset of accessible data, with no write or availability effect. |
| Impact | This is a moderate-severity information-disclosure flaw rather than a top-tier priority. The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates a network-reachable, low-complexity, unauthenticated vector requiring no user interaction, which raises exploitability, but impact is capped at low confidentiality (read access to only 'a subset' of Essbase data) with no integrity or availability effect and no scope change. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. One notable tension: the input Tags include 'Authentication Bypass', yet the description and CVSS (PR:N) characterize this as unauthenticated read-only data exposure, not a privilege/authentication bypass - the 'Authentication Bypass' label appears imprecise and should be verified against the Oracle advisory. Net assessment: patch in the normal Oracle CPU cycle; the easy unauthenticated network vector warrants attention, but the limited confidentiality-only impact keeps this below critical priority absent evidence of active exploitation. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker with HTTP access to an exposed Oracle Essbase 21.8.3.0.0 instance sends a crafted request to the Security component and retrieves a subset of data they should not be able to read. No exploit code is publicly identified, and the low attack complexity (AC:L) means no special timing or race conditions are needed once the endpoint is reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
An unauthenticated information-disclosure flaw in the Security component of Oracle Essbase 21.8.3.0.0 allows a remote attacker with HTTP network access to read a limited subset of data the application can access, without requiring credentials or user interaction. Confidentiality impact is partial (C:L) with no integrity or availability effect, giving a CVSS 3.1 base score of 5.3. No public exploit code or confirmed active exploitation was identified at time of analysis; the practical risk is concentrated on internet-reachable or weakly segmented Essbase HTTP deployments.
RemediationAI
Apply the Oracle CPU October 2026 fixes referenced in https://www.oracle.com/security-alerts/cpuoct2026.html; no exact patched build number is stated in the supplied data, so confirm the minimum fixed release in that advisory for the 21.8.3.0.0 line before upgrading. Until patching is complete, reduce exposure by restricting network reachability to the Essbase HTTP service - place it behind a reverse proxy or WAF with allow-listed client ranges, or firewall the listener to trusted subnets, accepting that this breaks access for legitimate external users. Disabling or blocking unused HTTP endpoints and features in the Security component narrows the attack surface at the cost of losing those functions, and additional monitoring of anomalous unauthenticated read requests against Essbase helps detect probing. Rotate or review any credentials and data whose confidentiality depends on Essbase access controls, since the weakness is an access-control rather than a cryptographic failure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Essbase is a multidimensional OLAP/analytic database server whose web tier exposes HTTP endpoints for query and administrative operations. The flaw resides in the 'Security' component, and the assigned tag 'Authentication Bypass' indicates that access-control enforcement on some HTTP-reachable path is incomplete, permitting an unauthenticated caller to obtain a subset of readable data. The CVSS vector AV:N/AC:L/PR:N/UI:N with S:U and C:L/I:N/A:N confirms the attack is network-based, low complexity, pre-authentication and non-interactive, and strictly confidentiality-limited; no CWE was supplied, so the exact root-cause class (e.g., missing authorization check versus improper access control) cannot be confirmed from the available data. Because the leakage is bounded to information the vulnerable service can already reach, the exposure is proportionate to what the affected Essbase instance itself may read.
Know when Essbase gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description confirms unauthenticated HTTP network access (AV:N/PR:N/UI:N) with easy exploitation (AC:L) yielding partial read access only, so C:L and I:N/A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verificatio
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcar
This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. Rat
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Acto
Oracle Essbase 21.8.3.0.0 (Security component) permits a low-privileged authenticated user to take full control of the E
Authenticated low-privileged attackers with network access to Oracle Essbase 21.8.3.0.0's T3/IIOP listeners can achieve
Remote takeover of Oracle Essbase 21.8.3.0.0 is possible for low-privileged authenticated attackers with HTTP network ac
Oracle Essbase 21.8.3.0.0 contains an easily exploitable flaw in its Security component that lets a low-privileged, netw
Exploit-DB