What is the CVSS score of CVE-2026-22010?

CVE-2026-22010 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Oracle OFSAA are affected by CVE-2026-22010?

Oracle Financial Services Analytical Applications Infrastructure (OFSAA) versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 contain an unauthenticated remote vulnerability allowing attackers to read sensitive…

How to fix or mitigate CVE-2026-22010?

Within 24 hours, inventory all OFSAA deployments to identify instances running versions 8.0.7.9, 8.0.8.7, or 8.1.2.5 and their network exposure to remote access. Within 7 days, implement network segmentation to restrict HTTP access to the OFSAA Platform component to authorized internal networks only, enforce TLS/HTTPS encryption at the load balancer level, and deploy WAF rules requiring authentication. Within 30 days, evaluate upgrade paths to OFSAA versions beyond 8.1.2.5, implement application-level authentication enforcement, establish continuous monitoring for anomalous data access patterns, and establish tracking for Oracle's patch release timeline.

Oracle OFSAA CVE-2026-22010

EUVD-2026-24317 HIGH

Improper Access Control (CWE-284)

2026-04-21 oracle

GHSA-3qgj-9j4x-cvhx

Authentication Bypass Oracle Oracle Financial Services Analytical Applications Infrastructure Oracle Corporation

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network HTTP access with low complexity yields high confidentiality loss only; no integrity or availability impact per the access-control disclosure nature.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:34 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24317

CVE Published

Apr 21, 2026 - 20:35 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Financial Services Analytical Applications Infrastructure accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Financial Services Analytical Applications Infrastructure (OFSAA) 8.0.7.9, 8.0.8.7, and 8.1.2.5 allows a remote, unauthenticated attacker to reach protected data over HTTP against the Platform component. Successful exploitation yields read access to critical or all OFSAA-accessible data with no integrity or availability impact. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%, 9th percentile), consistent with CISA SSVC scoring exploitation as 'none.'

Technical ContextAI

OFSAA is Oracle's analytical platform used by banks and financial institutions for risk, finance, and regulatory reporting; the flaw resides in the shared Platform component that underpins these applications. The root cause is classified as CWE-284 (Improper Access Control), and the 'Authentication Bypass' tag indicates the Platform fails to properly enforce authorization on an HTTP-accessible interface, letting an unauthenticated request retrieve data it should not reach. Because the impact is confidentiality-only (C:H/I:N/A:N), the weakness exposes stored/served data rather than permitting modification or code execution. The single CPE, cpe:2.3:a:oracle_corporation:oracle_financial_services_analytical_applications_infrastructure, confirms the affected product is OFSAA itself rather than an underlying library.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of April 2026 (patch available per vendor advisory at https://www.oracle.com/security-alerts/cpuapr2026.html); Oracle CPU patches are cumulative, so apply the relevant April 2026 patch for your OFSAA release line (8.0.7.x, 8.0.8.x, or 8.1.2.x) rather than an isolated hotfix. No exact fixed sub-version string is provided in the input data, so confirm the precise patched build against the CPU advisory for your platform. Until patched, restrict network reachability of the OFSAA Platform HTTP interface to trusted management networks or a VPN, place it behind a reverse proxy or WAF that enforces authentication on all endpoints, and monitor access logs for unauthenticated requests to data-serving paths; note these controls reduce exposure but do not fix the underlying access-control defect and may disrupt legitimate integrations that call OFSAA over HTTP.