Oracle Essbase EUVD-2026-106819

Exploitation requires the attacker to possess a valid low-privilege account on Oracle Essbase (PR:L) and network reachability to the Essbase HTTP interface; no user interaction is needed. The vulnerability resides in the Essbase Security component and affects version 21.8.3.0.0 specifically. The limiting factor is the authentication requirement - this is not reachable by fully anonymous/unauthenticated attackers - so realistic risk is bounded by how broadly low-privilege Essbase accounts are provisioned and how exposed the HTTP endpoint is. The scope change means a successful attack may reach data in products connected to Essbase, widening impact beyond the Essbase instance itself.

This is a genuine mid-tier priority rather than a theoretical issue, but it falls short of emergency status. The CVSS 3.1 base score of 7.7 is driven by a favorable attack profile for the attacker: AV:N (network), AC:L (low complexity), PR:L (low privileges required), UI:N (no user interaction), combined with a scope change (S:C) and high confidentiality impact (C:H) with no integrity or availability impact. The scope change is the primary reason the score reaches 7.7 despite only one impact dimension - Oracle notes attacks may significantly affect additional products beyond Essbase itself. Countervailing signals materially lower the urgency: there is no CISA KEV listing, no public exploit code identified, and no EPSS probability was supplied in the input, so there is no evidence of active or imminent exploitation. A key conflict exists in the input metadata: the 'Authentication Bypass' tag contradicts the CVSS vector and Oracle's own description, both of which state a 'low privileged attacker' (PR:L) - i.e., the attacker must already be authenticated, so this is NOT an unauthenticated auth-bypass. Treat the tag as unreliable and the PR:L requirement as the controlling fact. Net: a real, remotely exploitable confidentiality/data-disclosure flaw requiring a valid low-privilege account, worth prioritizing in Oracle CPU patching cycles but not a drop-everything event absent exploitation evidence.

An attacker holding a low-privilege Essbase account sends crafted HTTP requests to the Essbase Security component to abuse a flaw that lets them read data beyond their authorization, exposing all Essbase-accessible data and - because of the scope change - potentially data in connected products. No public proof-of-concept exploit has been identified, and low attack complexity means a knowledgeable authenticated user could likely trigger it reliably once the mechanism is understood.