EUVD-2026-24436
GHSA-94w8-x4g3-jq5m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Transaction Filtering UI over HTTP
-
DeliverySend request to protected endpoint
-
ExploitBypass access control (CWE-284)
-
ExecutionRead sanctions/transaction data
-
ImpactExfiltrate accessible confidential data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network HTTP reachability to the Oracle Financial Services Transaction Filtering User Interface component on an affected 8.1.2.8.0 instance - no authentication, no user interaction, and low complexity (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is exposure: these financial-compliance applications are typically deployed on internal or segmented banking networks rather than the public internet, so an attacker must first have access to the network segment hosting the UI. Impact is confined to confidentiality (C:H, I:N, A:N) - data can be read but not altered - and only version 8.1.2.8.0 is confirmed affected. |
| Impact | The signals are mixed and lean toward lower real-world urgency than the 7.5 base score suggests. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes an easy, remote, unauthenticated attack with high confidentiality impact but no integrity or availability effect. However, EPSS is very low at 0.03% (9th percentile), CISA/SSVC exploitation status is 'none', and no POC or KEV listing exists - so exploitation is currently theoretical, not observed. SSVC does flag Automatable: yes and Technical Impact: partial, meaning that IF an exploit emerges it could be scripted at scale, which raises the ceiling of concern. The 'Authentication Bypass' tag is community-supplied and slightly broader than Oracle's confidentiality-only description; treat the exact mechanism as inferred rather than confirmed. Net: a genuine confidentiality risk in a high-value financial-compliance system, but not an emergency - patch on Oracle's quarterly cadence and monitor for POC development. |
| Exploit ScenarioDerived | An attacker who can reach the Transaction Filtering web UI over HTTP sends crafted requests to protected endpoints and, because access control is not enforced, receives sensitive screening/transaction data without logging in. No public exploit code is currently identified, but SSVC marks the attack as automatable, so a single working request could be scripted to harvest data across many hosts. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Unauthenticated information disclosure in Oracle Financial Services Transaction Filtering 8.1.2.8.0 (User Interface component) allows a remote attacker with only network/HTTP access to read all data accessible to the application. Oracle rates it CVSS 7.5 (confidentiality-only), and community tagging labels it an authentication bypass; there is no public exploit identified at time of analysis, with EPSS at a low 0.03% (9th percentile) and SSVC exploitation status 'none'.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of April 2026 (patch available per vendor advisory at https://www.oracle.com/security-alerts/cpuapr2026.html); an exact fixed build number is not stated in the available data, so identify the correct patch for the 8.1.2.8.0 deployment directly from that CPU advisory. Until patched, reduce exposure by restricting network reachability of the Transaction Filtering User Interface to trusted internal management networks or VPN only, placing it behind a reverse proxy/WAF that enforces authentication on all UI endpoints, and blocking direct HTTP access from untrusted zones - the trade-off is that legitimate remote operators must route through the VPN/proxy. Increase logging and monitoring of anonymous or unauthenticated HTTP requests to the UI to detect probing while the patch is scheduled.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is Oracle Financial Services Transaction Filtering, a sanctions/watchlist screening application used by banks to filter transactions against regulatory lists. The flaw lives in the web-facing User Interface component and is classified as CWE-284 (Improper Access Control), meaning the application fails to correctly enforce authorization/authentication on data it exposes over HTTP. The 'Authentication Bypass' tag combined with PR:N in the CVSS vector indicates a request path that returns protected data without valid credentials. The single affected CPE is cpe:2.3:a:oracle_corporation:oracle_financial_services_transaction_filtering, confirming a Java/web enterprise application rather than an OS or library component.
Know when Oracle Financial Services Transaction Filtering gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Remote unauthenticated HTTP access with low complexity yields AV:N/AC:L/PR:N/UI:N; impact is data disclosure only, so C:H with I:N/A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Financial Services Transaction Filtering product of Oracle Financial Services Applications (component: User Interface). The supported version that is affected is 8.1.2.8.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Transaction Filtering. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Financial Services Transaction Filtering accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Executive ViewAI
Oracle Financial Services Transaction Filtering 8.1.2.8.0 contains an unauthenticated information disclosure vulnerability that allows remote attackers to read all data accessible to the application, creating direct exposure of sensitive financial information. This authentication bypass affects the web UI with no current vendor patch available, requiring immediate access controls to reduce exposure window.
Implement network segmentation and firewall rules to restrict access to authorized networks only; deploy a Web Application Firewall with rules to monitor and log access attempts to sensitive endpoints; enable comprehensive audit logging of all data access; enforce multi-factor authentication via reverse proxy authentication layer; conduct immediate review of access logs to identify any unauthorized data access since system deployment.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB