Oracle Essbase EUVD-2026-106846

Exploitation requires network HTTP access to an Oracle Essbase 21.8.3.0.0 instance and valid low-privileged credentials (PR:L) targeting the Build component - it is NOT unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so any authenticated low-privilege user can trigger it reliably. The scope change (S:C) means successful attacks can reach data in additional products beyond Essbase itself. Limiting factors: the attacker must first obtain an account, the instance must be network-reachable, and impact is confined to confidentiality (no integrity or availability effect).

This is a genuine mid-tier priority rather than a top-of-queue emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, score 7.7) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with a scope change amplifying impact to additional products - a realistic combination for an authenticated attacker with any foothold. However, impact is confined to confidentiality (C:H, I:N, A:N): it enables data disclosure, not tampering or denial of service. No EPSS score, no CISA KEV listing, and no POC were provided in the input, so there is no evidence of active exploitation or public exploit code at this time. The 'Authentication Bypass' tag directly CONFLICTS with the CVSS vector, which specifies PR:L (valid low-privileged credentials required) - this is not an unauthenticated bypass, and the tag should be treated as unreliable pending vendor confirmation. Net assessment: a credible confidentiality risk in authenticated/internal threat models, but absent exploitation signals it is not an immediate drop-everything issue; prioritize via normal Oracle CPU patching cadence.

An attacker who already holds low-privileged credentials on an exposed Oracle Essbase instance sends crafted HTTP requests to the Build component. Because of the scope change, the attack yields unauthorized read access to critical Essbase data and can significantly impact additional connected products. No public proof-of-concept was identified at time of analysis, and the low attack complexity (AC:L) means exploitation is reliable once credentials are obtained.