EUVD-2026-61869
GHSA-fjcx-6q79-f4vv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible Web UI requires only a low-privilege authenticated account with no user interaction; full CIA impact is consistent with the described system takeover outcome.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Financial Services Enterprise Case Management product of Oracle Financial Services Applications (component: Web UI). Supported versions that are affected are 8.0.8.2 and 8.1.2.11. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Enterprise Case Management. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Enterprise Case Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full system takeover of Oracle Financial Services Enterprise Case Management versions 8.0.8.2 and 8.1.2.11 is achievable by low-privileged, network-authenticated attackers targeting the Web UI component over HTTP. Oracle rates this as easily exploitable with a CVSS 3.1 score of 8.8, reflecting full confidentiality, integrity, and availability impact - consistent with complete application compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must possess a valid low-privileged account on the Oracle Financial Services Enterprise Case Management platform, providing authenticated HTTP network access to the Web UI component. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.8 reflects genuinely high exploitability: the attack is network-accessible, requires low complexity, no user interaction, and only a low-privilege authenticated account - making it accessible to any standard platform user rather than requiring administrative credentials or external attacker foothold escalation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Patch Update (CPU) published in August 2026, available via the Oracle security advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances of Oracle Financial Services Enterprise Case Management versions 8.0.8.2 and 8.1.2.11 in your environment and disable or restrict internet-facing Web UI access where operationally feasible, communicating any service limitations to stakeholders. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is po
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), thi
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally lead
When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally lead
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads
When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result
Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today