Oracle Essbase EUVD-2026-106818

Exploitation requires an authenticated low-privileged account (PR:L) with HTTP network access to the Oracle Essbase Security component on an affected 21.8.3.0.0 instance; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The limiting factor is the credential requirement - anonymous/unauthenticated attackers cannot exploit this per the CVSS vector - so realistic risk depends on how broadly low-trust accounts are provisioned on the Essbase HTTP interface and whether that interface is network-exposed. The scope change (S:C) means successful reads may reach data in additional connected products, widening impact beyond Essbase for environments where such integrations exist.

This is a moderate-severity information-disclosure flaw (CVSS 3.1 base 5.0) rather than a top-tier priority. The vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) indicates network-reachable, low-complexity exploitation, but it requires an already-authenticated low-privileged account (PR:L) and yields only partial, read-only confidentiality impact (C:L) with no integrity or availability effect. The scope change (S:C) is the one aggravating signal - Oracle explicitly notes attacks 'may significantly impact additional products,' meaning the disclosed data could extend beyond Essbase itself, which is why the score is elevated above a purely local info leak. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no evidence of active or imminent exploitation; real-world risk is currently theoretical and gated behind valid credentials. Note a signal conflict worth flagging: the input Tags include 'Authentication Bypass,' but the CVSS vector requires privileges (PR:L) and limits impact to unauthorized read of a data subset - characteristics of an authenticated information-disclosure bug, not an authentication bypass. Treat the tag with skepticism and verify against Oracle's CPU October 2026 advisory. Overall: patch in the normal Oracle CPU cycle; this is not an emergency unless Essbase exposes sensitive cross-product data to low-trust users.

A low-privileged but authenticated user of an Oracle Essbase 21.8.3.0.0 deployment sends crafted HTTP requests to the Security component and obtains unauthorized read access to a subset of Essbase-accessible data, potentially including data belonging to other connected products due to the scope change. No public exploit code was identified at the time of analysis, and exploitation presumes the attacker already holds valid (if minimal) credentials on the HTTP interface.