Essbase
Vendor:
First CVE: Aug 30, 2019 · Active for 6 years
23
Total CVEs
More Total CVEs than 95% of tracked products
3.8
Avg CVEs / Year
Higher CVE frequency than 83% of tracked products
6.1
Avg CVSS
Higher Avg CVSS than 21% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Essbase over time
Volume of CVEsAvg CVSS Base Score
First CVE
Aug 30, 2019
6 years ago
Most Recent CVE
Oct 21, 2025
276 days ago
CVE Severity & Scoring
Essbase23 CVEs
17%
43%
35%
All CVEs352,231 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local1 (4.3%)
Network22 (95.7%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low11 (47.8%)
High12 (52.2%)
Unknown0 (0.0%)
User Interaction
None17 (73.9%)
Unknown0 (0.0%)
Required6 (26.1%)
Privileges Required
Low1 (4.3%)
High2 (8.7%)
None20 (87.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (23 CVEs).
23 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-3711CRITICAL In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first tim | Aug 24, 2021 | 9.8 | 79 | NO | NO |
CVE-2021-22901HIGH curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malic | Jun 11, 2021 | 8.1 | 60 | NO | NO |
CVE-2021-3449MEDIUM An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms | Mar 25, 2021 | 5.9 | 57 | NO | NO |
CVE-2021-3712HIGH ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This cont | Aug 24, 2021 | 7.4 | 53 | NO | NO |
CVE-2019-12402HIGH The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a | Aug 30, 2019 | 7.5 | 33 | NO | NO |
CVE-2020-8285HIGH curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing. | Dec 14, 2020 | 7.5 | 28 | NO | NO |
CVE-2025-61763HIGH Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.7.3.0.0. Easily exploitable vulnerability allows low privileged at | Oct 21, 2025 | 8.1 | 26 | NO | NO |
CVE-2021-20718HIGH mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors. | May 20, 2021 | 7.5 | 26 | NO | NO |
CVE-2020-8286HIGH curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response. | Dec 14, 2020 | 7.5 | 26 | NO | NO |
CVE-2020-7760HIGH This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github. | Oct 30, 2020 | 7.5 | 25 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (23 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (23 CVEs).
Media Mentions
Signals from CVEs in this product scope (23 CVEs).
Top CNAs Publishing CVEs For Essbase
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 21.7.3.0.0 | 1 | 8.1 | 0.3% | 0 | 0 |
| 21.4.3.0.0 | 1 | 2.2 | 0.4% | 0 | 0 |
| 21.4 | 3 | 5.3 | 0.5% | 0 | 0 |
| 21.3 | 2 | 6.6 | 25.4% | 0 | 0 |
| 21.2 | 10 | 6.0 | 12.6% | 0 | 0 |
| 11.1.2.4.47 | 1 | 6.1 | 2.2% | 0 | 0 |