Oracle Revenue Management CVE-2025-50075

Exploitation requires a valid low-privilege account (PR:L) on an Oracle Financial Services Revenue Management and Billing deployment running an affected version (2.9.0.0.0 through 7.2.0.0.0) with the Security Management System component, reachable over HTTP. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the authentication requirement is the primary limiting factor - an external unauthenticated attacker cannot exploit this directly. Impact is confined to unauthorized reading of data (C:H); no data modification or service disruption occurs (I:N/A:N).

All signals point to a moderate, not urgent, priority. The Oracle-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes an authenticated (PR:L) network attacker reading critical data with no integrity or availability impact - a confidentiality-only information-disclosure flaw. EPSS is low at 0.33% (24th percentile), there is no CISA KEV listing, and no public exploit code has been identified, so there is no evidence of real-world exploitation. The 'Easily exploitable' phrasing in Oracle's advisory aligns with AC:L but is tempered by the PR:L requirement: the attacker must already hold a valid low-privilege account on the application. The only notable tension is the 'Authentication Bypass' tag, which conflicts with the vector itself: PR:L means valid credentials are required, so this is a broken-access-control / horizontal-or-vertical authorization issue (consistent with the assigned CWE-284 Improper Access Control), not a bypass of authentication. Net: a legitimate patch-worthy issue in a sensitive financial product, but not a high-urgency widespread-exploitation threat.

A low-privileged user with a valid account on an Oracle Financial Services Revenue Management and Billing instance sends crafted HTTP requests to the Security Management System component to reach data beyond their authorization level, returning critical billing/revenue records. No public exploit code is known, and the attack requires no victim interaction, only existing low-level access.