Oracle OFSAAI CVE-2026-34321

Exploitation requires the attacker to hold an active, valid low-privileged account within the OFSAAI platform (PR:L) - unauthenticated external exploitation is not possible. The attack complexity is rated High (AC:H), indicating that beyond account access, specific conditions or timing must align for the authorization bypass to succeed. A separate human user (other than the attacker) must actively interact with attacker-influenced content or a crafted request, as reflected in UI:R; this interaction prerequisite is the primary limiting factor against automated or widespread exploitation. The vulnerability is confined to OFSAAI versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 running the web-based User Interface component accessible over HTTP. Exploitation is limited to confidentiality impact only - no integrity modification or availability disruption is achievable through this vector.

The overall risk profile is medium-low despite the C:H confidentiality rating. CVSS 3.1 scores 4.8, reflecting significant mitigating factors: AC:H (difficult to exploit), PR:L (attacker must hold a valid low-privileged account), and UI:R (a second user must interact), all of which substantially reduce real-world exploitability. EPSS at 0.03% (9th percentile) independently confirms near-zero observed exploitation activity. SSVC signals reinforce this: exploitation is assessed as 'none', the attack is not automatable (consistent with UI:R), and technical impact is 'partial'. There is no CISA KEV listing and no known public exploit code. The primary concern is insider-threat scenarios or targeted attacks within financial institutions where low-privileged OFSAAI accounts are accessible to a broader internal population. The confidentiality impact (C:H) is the sole severity driver; integrity and availability are unaffected, limiting the blast radius to data disclosure. No conflicting signals exist - all available intelligence sources align on a moderate-priority, non-urgent patch cadence.

An attacker holding a low-privileged OFSAAI account - such as a read-only analyst user - crafts a malicious HTTP request or link targeting the vulnerable User Interface component and socially engineers a higher-privileged user (e.g., an administrator) into clicking it, satisfying the required human interaction. Upon the victim's interaction, the authorization bypass is triggered, granting the attacker read access to data classified beyond their permission level, potentially including sensitive regulatory, risk, or financial datasets managed by the platform. No public exploit or proof-of-concept code is known to exist at time of analysis.