Oracle Essbase EUVD-2026-106841

Requires a valid low-privileged Oracle Essbase account (PR:L) with network HTTP access to the Essbase server; exploitation targets the Security component of version 21.8.3.0.0. No user interaction and no elevated/admin privileges are required beyond the initial authenticated session, and no non-default feature toggle is named in the description. The key limiting factor is the prerequisite authenticated account - this is not exploitable by fully unauthenticated attackers - which, combined with only partial (Low) confidentiality, integrity, and availability impact and unchanged scope, bounds realistic risk to users who can already reach and log into the Essbase service.

This is a moderate-severity, low-priority vulnerability by current signals. The CVSS 3.1 base score is 6.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, meaning network-reachable over HTTP, low attack complexity, no user interaction, but requiring an existing low-privileged authenticated account. Impacts are all 'Low' across confidentiality, integrity, and availability (partial data read/modify and partial DoS), and scope is unchanged - so this is not a full-system-compromise bug. No EPSS score is present in the input, the CVE is NOT in CISA KEV, and no public POC is referenced, so there is no evidence of active or imminent exploitation. The single reference is Oracle's October 2026 Critical Patch Update (cpuoct2026.html), consistent with a routine quarterly patch rather than an emergency fix. The main caveat is the PR:L requirement: 'low privileged attacker' means an attacker must already hold a valid Essbase account, which meaningfully limits mass exploitation and points toward insider or post-foothold abuse rather than widespread unauthenticated attacks. No conflicting signals were detected between the description and the CVSS vector.

An attacker who already possesses a low-privileged Oracle Essbase account sends crafted HTTP requests that abuse a flaw in the Security component to read a subset of data, perform unauthorized inserts/updates/deletes on some accessible data, and degrade availability (partial DoS). No user interaction or elevated privileges are needed beyond the initial authenticated session. No public exploit code is referenced, so exploitation would currently require independent research.