This vulnerability affects Oracle Essbase component Infrastructure in version 21.8.1.0.0. It is easily exploitable remotely without authentication via HTTP, enabling attackers to compromise the system fully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires no privileges or user interaction and results in high impact across confidentiality, integrity, and availability. Oracle has published an advisory as part of its August 2026 Critical Security Patch Update, which addresses this and many other vulnerabilities. However, the input data does not explicitly confirm the availability of a patch for this specific version or vulnerability.

Successful exploitation can lead to complete takeover of Oracle Essbase, compromising confidentiality, integrity, and availability of the system. This could allow attackers to execute arbitrary code, access sensitive data, and disrupt service.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update program. Although the advisory references a large update containing many patches, the specific patch status for version 21.8.1.0.0 regarding this vulnerability is not explicitly confirmed in the provided data. Users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions. Until patched, restricting network access to Oracle Essbase HTTP interfaces may reduce exposure.