EUVD-2026-24317
GHSA-3qgj-9j4x-cvhx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach OFSAA HTTP interface
-
ExploitSend crafted request to protected endpoint
-
ExecutionBypass access control (CWE-284)
-
ImpactRead critical financial data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker needs network HTTP access to the OFSAA Platform component of an affected version (8.0.7.9, 8.0.8.7, or 8.1.2.5); no authentication, credentials, or user interaction are required (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is reachability - exploitation requires the OFSAA HTTP interface to be routable to the attacker, so deployments restricted to isolated internal networks or fronted by an authenticating gateway sharply reduce exposure. Impact is bounded to data disclosure only (C:H/I:N/A:N); the attacker cannot modify data or disrupt service through this flaw. |
| Impact | The CVSS 3.1 base score is 7.5 (High) driven entirely by confidentiality (AV:N/AC:L/PR:N/UI:N/C:H), meaning easy, unauthenticated, network-reachable data exposure - a genuinely attractive target profile for internet- or intranet-exposed instances. However, corroborating exploitation signals are weak and consistent with each other: EPSS is 0.03% (9th percentile), CISA SSVC rates Exploitation as 'none' and Automatable as 'no,' and Technical Impact is only 'partial.' No KEV listing and no known POC exist. The tension to note is that a low-complexity unauthenticated confidentiality flaw looks severe on paper, yet all real-world exploitation indicators are currently low, suggesting no observed activity rather than low exploitability. Given OFSAA holds sensitive financial data, defenders should treat this as a real patch priority for exposed instances even though it is not evidence of active exploitation. |
| Exploit ScenarioDerived | An attacker who can reach the OFSAA Platform HTTP interface - for example on an exposed internal application server or an internet-facing deployment - sends a crafted request to a data-serving endpoint that fails to enforce authorization. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low, the attacker retrieves critical financial data directly. No public POC has been identified, so exploitation would require an attacker to independently discover the vulnerable request pattern. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Unauthorized data disclosure in Oracle Financial Services Analytical Applications Infrastructure (OFSAA) 8.0.7.9, 8.0.8.7, and 8.1.2.5 allows a remote, unauthenticated attacker to reach protected data over HTTP against the Platform component. Successful exploitation yields read access to critical or all OFSAA-accessible data with no integrity or availability impact. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%, 9th percentile), consistent with CISA SSVC scoring exploitation as 'none.'
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of April 2026 (patch available per vendor advisory at https://www.oracle.com/security-alerts/cpuapr2026.html); Oracle CPU patches are cumulative, so apply the relevant April 2026 patch for your OFSAA release line (8.0.7.x, 8.0.8.x, or 8.1.2.x) rather than an isolated hotfix. No exact fixed sub-version string is provided in the input data, so confirm the precise patched build against the CPU advisory for your platform. Until patched, restrict network reachability of the OFSAA Platform HTTP interface to trusted management networks or a VPN, place it behind a reverse proxy or WAF that enforces authentication on all endpoints, and monitor access logs for unauthenticated requests to data-serving paths; note these controls reduce exposure but do not fix the underlying access-control defect and may disrupt legitimate integrations that call OFSAA over HTTP.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OFSAA is Oracle's analytical platform used by banks and financial institutions for risk, finance, and regulatory reporting; the flaw resides in the shared Platform component that underpins these applications. The root cause is classified as CWE-284 (Improper Access Control), and the 'Authentication Bypass' tag indicates the Platform fails to properly enforce authorization on an HTTP-accessible interface, letting an unauthenticated request retrieve data it should not reach. Because the impact is confidentiality-only (C:H/I:N/A:N), the weakness exposes stored/served data rather than permitting modification or code execution. The single CPE, cpe:2.3:a:oracle_corporation:oracle_financial_services_analytical_applications_infrastructure, confirms the affected product is OFSAA itself rather than an underlying library.
Know when Oracle Financial Services Analytical Applications Infrastructure gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network HTTP access with low complexity yields high confidentiality loss only; no integrity or availability impact per the access-control disclosure nature.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Financial Services Analytical Applications Infrastructure accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Executive ViewAI
Oracle Financial Services Analytical Applications Infrastructure (OFSAA) versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 contain an unauthenticated remote vulnerability allowing attackers to read sensitive financial information over HTTP. Organizations using affected OFSAA instances face regulatory exposure and potential disclosure of confidential financial data, with no vendor patch currently available.
Implement network segmentation to restrict OFSAA Platform HTTP access to authorized networks only; enforce HTTPS/TLS at load balancer or reverse proxy; deploy WAF rules requiring authentication headers; disable HTTP and require HTTPS-only connections; implement database-level access controls and monitoring for data exfiltration patterns; segment OFSAA infrastructure from untrusted networks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthorized data access in Oracle Financial Services Analytical Applications Infrastructure (OFSAA) versions 8.0.7.9, 8
Improper access control in Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) Platform component
Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 contain
Unauthorized data exposure in Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) versions 8.0.7.9
Improper authorization in the User Interface component of Oracle Financial Services Analytical Applications Infrastructu
Exploit-DB