EUVD-2026-24407
GHSA-jwr7-8589-p67w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach OFSAA HTTP interface over network
-
ExploitSend crafted request to Platform endpoint
-
ExecutionBypass access-control/authentication check
-
ImpactRead critical financial data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker needs network HTTP access to the OFSAA Platform component of an affected version (8.0.7.9, 8.0.8.7, or 8.1.2.5); per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special product configuration is required - exploitation works against standard deployments reachable over the network. The primary limiting factor is exposure: OFSAA is typically an internal enterprise financial-analytics platform, so instances not reachable from untrusted networks are far less exposed, and only the three named supported versions are confirmed affected. Impact is limited to unauthorized data reads (C:H); the flaw does not permit data modification (I:N) or service disruption (A:N). |
| Impact | Signals are moderately consistent but point to elevated-but-not-emergency risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes an easy, remote, unauthenticated attack, and the 7.5 base score is driven entirely by high confidentiality impact (C:H, I:N, A:N). CISA SSVC corroborates this: Automatable=yes (attackers can script mass exploitation) and Technical Impact=partial, but Exploitation=none means no observed activity. Counterbalancing the low-friction vector, EPSS is very low at 0.03% (9th percentile), the CVE is not in CISA KEV, and no public exploit is identified - so real-world exploitation is currently unproven. The tension worth flagging: an unauthenticated, automatable, network-reachable confidentiality flaw is exactly the profile that can be weaponized quickly if a POC emerges, yet OFSAA's niche financial-sector footprint limits mass-scanning appeal, which likely explains the low EPSS. Treat as a high-priority patch for OFSAA operators handling sensitive financial data, but not an active-exploitation fire drill at this time. |
| Exploit ScenarioDerived | An attacker who can reach the OFSAA web interface over HTTP sends crafted requests to a Platform endpoint that fails to enforce authorization, bypassing authentication to retrieve sensitive financial data without any credentials or user interaction. Because SSVC rates the flaw Automatable=yes, an adversary could script this against many exposed OFSAA instances. No public exploit code is identified at time of analysis, so exploitation would require independent development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Unauthorized data access in Oracle Financial Services Analytical Applications Infrastructure (OFSAA) versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 lets a remote, unauthenticated attacker read critical data over HTTP with no user interaction. The flaw stems from improper access control (CWE-284) in the Platform component and is tagged as an authentication bypass, though impact is limited to confidentiality (no data modification or denial of service). No public exploit has been identified at time of analysis and EPSS exploitation probability is very low (0.03%).
RemediationAI
Apply the fixes delivered in Oracle's April 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuapr2026.html), which is the authoritative source for the exact patched build for each affected line (8.0.7.9, 8.0.8.7, 8.1.2.5); Patch available per vendor advisory, but a specific fixed version string is not enumerated in the provided data, so confirm the target build in the CPU matrix before deployment. Because Oracle CPU patches are cumulative, prioritize scheduling the OFSAA patch through your standard Oracle maintenance window. As compensating controls until patching, restrict network reachability of the OFSAA HTTP interface to trusted internal networks or VPN-only access (trade-off: may disrupt legitimate remote or integration access), place the application behind a WAF or reverse proxy that enforces authentication on Platform endpoints, and increase monitoring of HTTP access logs for anomalous unauthenticated data-retrieval requests. These controls reduce exposure of the unauthenticated attack surface but do not remediate the underlying access-control flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OFSAA is Oracle's enterprise analytics and regulatory-reporting framework used by banks and financial institutions for risk, compliance, and financial modeling. The vulnerability resides in the Platform component, the shared infrastructure layer that handles authentication, session management, and data access across OFSAA modules, exposed via HTTP. The root cause is CWE-284 (Improper Access Control): the application fails to correctly enforce authorization on a network-reachable interface, allowing an actor to reach protected data without valid credentials. The 'Authentication Bypass' tag reinforces that access-control enforcement - not memory safety or injection - is the failure class. The CPE (cpe:2.3:a:oracle_corporation:oracle_financial_services_analytical_applications_infrastructure) confirms the affected product but uses a wildcard version, so precise affected ranges come from Oracle's advisory and the EUVD version list rather than the CPE string.
Know when Oracle Financial Services Analytical Applications Infrastructure gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated remote HTTP access with no user interaction yields AV:N/AC:L/PR:N/UI:N; impact is confidentiality-only data disclosure (C:H, I:N, A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Financial Services Analytical Applications Infrastructure accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Executive ViewAI
Oracle Financial Services Analytical Applications Infrastructure (OFSAA) versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 contain an unauthenticated remote vulnerability allowing attackers to read critical financial and analytical data over HTTP without credentials or user interaction. Organizations running these versions face potential exposure of sensitive financial information with no vendor patch currently available. Although exploitation probability remains minimal at present, the attack surface-remote, unauthenticated, requiring no user action-creates material confidentiality risk requiring immediate control assessment.
No vendor-released patch identified at time of analysis. Implement interim mitigations: (1) enforce HTTPS-only communication, disabling HTTP access entirely; (2) restrict network access via firewall rules and IP allowlisting to authorized networks only; (3) deploy WAF rules specifically targeting unauthorized data access patterns against the Platform component; (4) enable comprehensive audit logging of all data requests to OFSAA for forensic investigation; (5) require multi-factor authentication for all OFSAA access; (6) implement database activity monitoring to detect and alert on unauthorized data reads. Establish continuous monitoring for exploitation attempts in logs and network telemetry while awaiting vendor guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthorized data disclosure in Oracle Financial Services Analytical Applications Infrastructure (OFSAA) 8.0.7.9, 8.0.8.
Improper access control in Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) Platform component
Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 contain
Unauthorized data exposure in Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) versions 8.0.7.9
Improper authorization in the User Interface component of Oracle Financial Services Analytical Applications Infrastructu
Exploit-DB