What is the CVSS score of CVE-2026-35231?

CVE-2026-35231 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Oracle Financial Services Transaction Filtering are affected by CVE-2026-35231?

Oracle Financial Services Transaction Filtering 8.1.2.8.0 contains an unauthenticated information disclosure vulnerability that allows remote attackers to read all data accessible to the application,…

How to fix or mitigate CVE-2026-35231?

Within 24 hours, restrict network access to the Oracle Financial Services Transaction Filtering UI through firewall rules or IP allowlisting to authorized personnel only; verify no unauthorized access in application logs for the past 7 days. Within 7 days, conduct a vulnerability assessment to identify what data classes are exposed and review audit logs for evidence of exploitation. Within 30 days, work with Oracle to confirm patch timeline for version 8.1.2.8.0 or evaluate upgrade to a patched version; if upgrading is not feasible within 60 days, implement a reverse proxy with multi-factor authentication in front of the application as a compensating control.

Oracle Financial Services Transaction Filtering CVE-2026-35231

EUVD-2026-24436 HIGH

Improper Access Control (CWE-284)

2026-04-21 oracle

GHSA-94w8-x4g3-jq5m

Authentication Bypass Oracle Oracle Financial Services Transaction Filtering Oracle Corporation

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Remote unauthenticated HTTP access with low complexity yields AV:N/AC:L/PR:N/UI:N; impact is data disclosure only, so C:H with I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:06 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24436

CVE Published

Apr 21, 2026 - 20:35 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Financial Services Transaction Filtering product of Oracle Financial Services Applications (component: User Interface). The supported version that is affected is 8.1.2.8.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Transaction Filtering. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Financial Services Transaction Filtering accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthenticated information disclosure in Oracle Financial Services Transaction Filtering 8.1.2.8.0 (User Interface component) allows a remote attacker with only network/HTTP access to read all data accessible to the application. Oracle rates it CVSS 7.5 (confidentiality-only), and community tagging labels it an authentication bypass; there is no public exploit identified at time of analysis, with EPSS at a low 0.03% (9th percentile) and SSVC exploitation status 'none'.

Technical ContextAI

The affected product is Oracle Financial Services Transaction Filtering, a sanctions/watchlist screening application used by banks to filter transactions against regulatory lists. The flaw lives in the web-facing User Interface component and is classified as CWE-284 (Improper Access Control), meaning the application fails to correctly enforce authorization/authentication on data it exposes over HTTP. The 'Authentication Bypass' tag combined with PR:N in the CVSS vector indicates a request path that returns protected data without valid credentials. The single affected CPE is cpe:2.3:a:oracle_corporation:oracle_financial_services_transaction_filtering, confirming a Java/web enterprise application rather than an OS or library component.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of April 2026 (patch available per vendor advisory at https://www.oracle.com/security-alerts/cpuapr2026.html); an exact fixed build number is not stated in the available data, so identify the correct patch for the 8.1.2.8.0 deployment directly from that CPU advisory. Until patched, reduce exposure by restricting network reachability of the Transaction Filtering User Interface to trusted internal management networks or VPN only, placing it behind a reverse proxy/WAF that enforces authentication on all UI endpoints, and blocking direct HTTP access from untrusted zones - the trade-off is that legitimate remote operators must route through the VPN/proxy. Increase logging and monitoring of anonymous or unauthenticated HTTP requests to the UI to detect probing while the patch is scheduled.