Oracle Revenue Management CVE-2025-50074

Exploitation requires the attacker to already hold HIGH privileges within Oracle Financial Services Revenue Management and Billing (CVSS PR:H) and network access to the application over HTTP targeting the Security Management System component; affected supported versions are 2.9.0.0.0 through 7.2.0.0.0. Limiting factors: the high-privilege precondition sharply narrows the viable attacker population to trusted administrators/operators or a post-compromise actor who has already obtained such an account; no user interaction is needed (UI:N), but no unauthenticated or low-privilege path exists. Oracle does not disclose the exact feature or configuration triggering the flaw, so the condition is the privilege level plus reachability of the SMS component rather than a specific non-default setting.

This is a moderate-severity information disclosure flaw (CVSS 3.1 base 4.9, CWE-200) whose signals consistently point to LOW real-world urgency. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) shows network-reachable, low-complexity exploitation but requires HIGH privileges (PR:H) - a key limiting factor that caps the score and means the attacker must already be a highly privileged user of the application. Impact is confidentiality-only (C:H, I:N, A:N): no data tampering or availability loss. The EPSS score is low (0.40%, 32nd percentile), it is NOT listed in CISA KEV, and no public exploit code is identified, so there is no evidence of active or imminent exploitation. There is a notable conflict in the input metadata: the tag 'Authentication Bypass' contradicts the CVSS PR:H requirement and the CWE-200 classification - this flaw requires strong pre-existing privileges and is an information-disclosure issue, not an authentication bypass; the tag appears mislabeled and should not drive prioritization. Overall this is a genuine but lower-priority issue: patch in the normal Oracle CPU cycle rather than as an emergency, given the high-privilege precondition and absence of exploitation signals.

A user who already holds high administrative/operational privileges in Oracle Financial Services Revenue Management and Billing sends crafted HTTP requests to the Security Management System component to read sensitive data they should not be able to access, resulting in full disclosure of all application-accessible data. No public proof-of-concept or exploit code is available, and the requirement for high existing privileges makes this most plausible as insider misuse or as a post-compromise privilege-leveraging step rather than external opportunistic attack.