Loading vulnerability…
Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as unauthorized update, insert or delete access to some of Oracle Essbase accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability in Oracle Essbase Web Platform 21.8.3.0.0 allows a low-privileged attacker with HTTP network access to read critical data or all Essbase-accessible data and modify, insert, or delete some accessible data. Exploitation requires no user interaction and may significantly affect additional products through a scope change. The CVSS 3.1 base score is 8.5, with high confidentiality impact, low integrity impact, and no availability impact.
A vulnerability in the Essbase Web Platform component of Oracle Essbase 21.8.3.0.0 allows a low-privileged attacker with HTTP network access to access critical data or all Essbase-accessible data and modify, insert, or delete some accessible data. Exploitation requires no user interaction and may significantly affect additional products. The CVSS v3.1 score is 8.5, with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. The record references Oracle's October 2026 security advisory but does not explicitly confirm patch availability or observed exploitation.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.