Oracle OFSAA CVE-2025-53037

Requires only network reachability to the OFSAA HTTP(S) application interface of an affected version (8.0.7.9, 8.0.8.7, or 8.1.2.5); per CVSS AV:N/AC:L/PR:N/UI:N and CWE-306, exploitation is unauthenticated against default configurations with no user interaction or special privileges. The primary limiting factor is exposure: OFSAA is typically deployed internally within financial institutions, so internet-facing instances are the main realistic attack surface, and organizations not running these specific versions are unaffected. Oracle does not publish the exact vulnerable endpoint, so defenders cannot scope to a single URL from the advisory alone.

Multiple signals point in different directions. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is maximal for a non-scope-change flaw: network-reachable, low complexity, no privileges, no user interaction, with full confidentiality/integrity/availability impact - consistent with CWE-306 (Missing Authentication) and the 'Authentication Bypass' tag, indicating unauthenticated full compromise ('takeover') over HTTP. However, the EPSS score is only 0.47% (39th percentile), which is low and suggests exploitation is not currently probable or widespread. There is no CISA KEV listing and no public exploit or POC identified in the provided data, so the high CVSS reflects theoretical worst-case impact rather than demonstrated in-the-wild activity. No SSVC decision data was provided. Net: this is a genuinely severe, easy-to-exploit-by-design flaw that warrants prompt patching where OFSAA is deployed, but the low EPSS, absence of KEV, and absence of public exploit code indicate it is not yet an active-exploitation emergency. The limited real-world deployment footprint of OFSAA (niche financial-sector software) further tempers aggregate risk relative to the raw 9.8.

An unauthenticated attacker with network access to the OFSAA web interface sends crafted HTTP requests to an endpoint that fails to enforce authentication (CWE-306), bypassing login entirely. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with full C/I/A impact, a single reachable instance can be taken over without credentials or user interaction. No public exploit code is identified at time of analysis, so exploitation would currently require the attacker to independently develop the request.