Oracle Essbase EUVD-2026-106839

Exploitation requires the attacker to hold a valid low-privileged account on the target Oracle Essbase instance (PR:L) and network HTTP reachability to the Essbase Security component; no user interaction is needed. The affected configuration is Oracle Essbase version 21.8.3.0.0. The practical limiting factor is the authentication requirement - an attacker must first obtain or be granted low-level Essbase credentials - which constrains this to insiders or attackers who have already gained a foothold, meaningfully reducing real-world exposure despite the network attack vector. Impact is bounded to reading a subset of accessible data, though the scope change means that disclosure may extend to additional connected products.

This is a moderate-severity, not high-priority, issue. The CVSS 3.1 base score is 5.0 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N - network-reachable over HTTP and low attack complexity, but it requires an attacker to already hold low-level privileges (PR:L), and the impact is limited to unauthorized read of a subset of Essbase data (C:L) with no integrity or availability effect. The scope change (S:C) is the one aggravating factor, indicating the confidentiality impact can reach beyond Essbase into additional products, which is why the score is not lower. No EPSS probability is supplied, there is no CISA KEV listing, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. A notable conflict exists in the metadata: the input carries an 'Authentication Bypass' tag, yet the CVSS vector requires authenticated low privileges (PR:L), so the vulnerability is NOT an unauthenticated auth bypass - verify the tag against Oracle's advisory. Net assessment: a credentialed-attacker information-disclosure flaw that warrants routine patching in the Oracle CPU cycle rather than emergency response.

An attacker who already possesses a low-privileged Essbase account sends crafted HTTP requests to the server's Security component to read data they are not authorized to see, with the scope change allowing that disclosure to extend into connected products. Because it is network-reachable with low complexity and no user interaction, the request is straightforward once valid low-level credentials are held. No public exploit code is identified at time of analysis.