Oracle OFSAAI CVE-2026-34325

Exploitation requires two concrete prerequisites that significantly constrain the attack surface. First, the attacker must already possess a low-privileged account with active local logon access to the infrastructure host where OFSAAI executes - the AV:L vector explicitly rules out remote or network-based exploitation, and PR:L confirms a valid but unprivileged account is required. Second, a separate, distinct user must actively interact with the OFSAAI User Interface component as part of the attack (UI:R) - this is not a passive click-jacking scenario where any web visit suffices, but a targeted social engineering or co-location scenario within the OFSAAI environment. What limits exploitation: remote attackers without local infrastructure access cannot exploit this; unauthenticated users cannot exploit this; fully automated attack chains are not possible (SSVC Automatable: no); and only the three specific OFSAAI versions (8.0.7.9, 8.0.8.7, 8.1.2.5) are confirmed vulnerable. No specific configuration or feature toggle is described as required beyond running an affected version.

The CVSS 3.1 base score of 6.8 (Medium) accurately reflects real-world exploitability constraints: local access (AV:L) eliminates internet-facing exposure, and the mandatory human interaction from a second user (UI:R) prevents automated or opportunistic attack chains. The SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial) reinforces this - the technical impact rating of 'partial' is notable given the C:H and A:H impacts, suggesting evaluators weighted the access prerequisites heavily. The EPSS score of 0.01% at the 2nd percentile signals virtually no observed exploitation activity or expected near-term weaponization. No CISA KEV listing and no public POC confirm this is not a priority threat for most defenders at this time. However, in the financial services sector, C:H impact against an analytics platform holding regulatory, financial, or customer data warrants prioritized patching within standard Oracle CPU cycles. Organizations with elevated insider threat risk profiles should treat this with greater urgency. No conflicting signals exist across the available data sources; all indicators are internally consistent.

An insider or compromised account holder with a valid low-privileged logon to the OFSAAI host infrastructure interacts with the vulnerable User Interface component and crafts or triggers a malicious UI state, then social-engineers a colleague - for example, via a shared terminal, forwarded link within the internal OFSAAI session, or a crafted dashboard element - to perform an interaction that triggers the CWE-284 access control bypass. Upon the victim's interaction, the attacker's session gains unauthorized read access to all data accessible by OFSAAI (financial models, regulatory datasets, user data) and can additionally cause the platform to hang or crash, disrupting analytical and reporting workflows. No public proof-of-concept exists, meaning this scenario requires attacker familiarity with the specific UI vulnerability mechanism.