Oracle OFSAA CVE-2025-53036

Exploitation requires network reachability to the OFSAA Platform component's HTTP interface; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special configuration are stated as prerequisites, so a reachable instance of the affected versions (8.0.7.9, 8.0.8.7, 8.1.2.5) is the primary requirement. The main limiting factor is exposure: OFSAA is a back-office financial analytics platform usually deployed inside institutional networks rather than internet-facing, so realistic risk is highest where the HTTP interface is accessible to an attacker. The scope change (S:C) means successful attacks can reach data in additional connected products, but the vulnerability yields confidentiality impact only (no data modification or denial of service). Oracle does not document a feature toggle or non-default mode as a precondition.

This is a confidentiality-only information-disclosure flaw (CWE-200) in Oracle Financial Services Analytical Applications Infrastructure (OFSAA), rated CVSS 3.1 8.6. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N is favorable to attackers on paper: network-reachable over HTTP, low complexity, no privileges (PR:N, unauthenticated), no user interaction, with a scope change (S:C) indicating impact beyond the vulnerable component and HIGH confidentiality impact (no integrity or availability impact). However, the real-world exploitation signals are modest and partly conflicting: EPSS is only 0.41% (33rd percentile), there is no CISA KEV listing, and no public exploit code has been identified, so the 'easily exploitable, unauthenticated' language from Oracle is not yet matched by observed exploitation activity. Net assessment: a genuinely attacker-friendly vector against an internet-facing OFSAA instance makes this worth prioritizing for financial institutions running affected versions, but the absence of KEV/POC and low EPSS suggest this is currently a patch-on-cycle priority rather than an emergency, and its narrow footprint (industry-specific banking software, typically not internet-exposed) further tempers aggregate risk. The high CVSS is driven largely by the scope change and unauthenticated network access rather than by evidence of mass exploitation.

A remote, unauthenticated attacker who can reach an OFSAA instance's HTTP interface sends crafted requests to the Platform component to retrieve sensitive financial data without any credentials or user interaction. Because of the scope change, the disclosure may extend to data belonging to additional connected products beyond OFSAA itself. No public proof-of-concept exploit has been identified at time of analysis, so a working exploit would require independent development.