Oracle OFSAA Infrastructure CVE-2025-61751

Requires a valid low-privileged authenticated account on the Oracle Financial Services Analytical Applications Infrastructure (OFSAA) instance plus network HTTP access to the Platform component; no special non-default configuration, user interaction, or elevated privileges are needed, and attack complexity is low. The key limiting factor is the authentication requirement (PR:L): the attacker must first obtain or possess credentials, which confines realistic exploitation to malicious insiders, compromised accounts, or reachable internal/exposed deployments rather than fully anonymous internet attackers. Only versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 are listed as affected.

This is a credible but non-emergency priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) describes an easily exploitable, network-reachable flaw over HTTP that yields high confidentiality and integrity impact, but critically requires PR:L - a low-privileged authenticated account - so it is NOT a pre-auth remote compromise despite the 'Authentication Bypass' tag. CWE-862 (Missing Authorization) is consistent with this: an authenticated low-privilege user can reach data/actions they should not. Exploitation signals are weak: EPSS is only 0.33% (24th percentile), there is no CISA KEV listing, and no public exploit was identified, so there is no public exploit identified at time of analysis. No SSVC decision data was provided. The signals are internally consistent rather than conflicting (high static severity, low real-world exploitation likelihood), pointing to a targeted insider/credentialed-access risk rather than widespread mass exploitation. One labeling conflict must be noted: the 'Authentication Bypass' tag contradicts both PR:L and CWE-862, which indicate an authenticated authorization flaw, not an authentication bypass - defenders should treat valid-credential access as a prerequisite.

An attacker who already holds a low-privileged OFSAA account (for example a limited analyst login) sends crafted HTTP requests to the Platform component and, due to missing authorization checks, reads or alters critical financial data they should not be able to touch. Because attack complexity is low and no user interaction is needed, the action is straightforward once valid credentials exist, though no public exploit has been identified.