Oracle FSAAI CVE-2025-53035

Requires a valid low-privileged account on the target Oracle Financial Services Analytical Applications Infrastructure instance (CVSS PR:L) with network HTTP access to the Platform component; no user interaction is needed (UI:N). Exploitation is limited to the specific affected versions 8.0.7.9, 8.0.8.7, and 8.1.2.5, and the attacker must be able to reach the application's HTTP interface - instances restricted to internal networks or placed behind strong network segmentation substantially reduce exposure. Impact is confined to unauthorized data disclosure; no write/modify or denial-of-service capability is conferred (I:N/A:N).

This is a moderate-priority confidentiality issue rather than a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity attack requiring low privileges (PR:L), with high confidentiality impact but no integrity or availability impact - consistent with CWE-284 (Improper Access Control) allowing an authenticated low-privileged user to read data they should not. Exploitation signals are weak: EPSS is only 0.33% (24th percentile), there is no CISA KEV listing, and no public exploit code has been identified, so there is no evidence of active or imminent widespread exploitation. The 'Authentication Bypass' tag conflicts with the CVSS PR:L metric and the CWE-284 classification - the flaw requires an existing low-privileged account, so it is an access-control/privilege issue, not a true pre-authentication bypass; treat the tag with suspicion and prioritize based on the official vector. Overall this is a real but non-urgent patch-cycle item: the high-confidentiality impact matters for a financial-data platform, but the authenticated prerequisite and low exploitation probability argue against crisis-level escalation.

An attacker who already holds a low-privileged application account on an exposed Oracle Financial Services Analytical Applications Infrastructure instance sends crafted HTTP requests to the Platform component to bypass access-control checks. Because the flaw is network-reachable and low-complexity, this grants unauthorized read access to critical or all OFSAA-accessible data without any user interaction. No public proof-of-concept exploit code has been identified at time of analysis.