Oracle OFSAAI EUVD-2026-24410

Exploitation requires a valid low-privilege account on the target OFSAAI instance (PR:L per CVSS vector), and network access to the application via HTTP. No special non-default configuration is required beyond having a functioning OFSAAI deployment on an affected version (8.0.7.9, 8.0.8.7, or 8.1.2.5). What limits exploitation: attackers must possess a credential for at least a low-privilege OFSAAI account; unauthenticated external attackers cannot exploit this directly. The 'not automatable' SSVC flag suggests that exploitation likely requires per-target interaction or manual query crafting rather than a fully automated spray attack. The vulnerability is scoped to data accessible within the OFSAAI platform (S:U), so lateral movement to unrelated systems is not directly implied by this CVE alone.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a realistic, network-exploitable flaw with low attack complexity - but requires at least a low-privilege account, which meaningfully limits the exposed attack surface compared to fully unauthenticated flaws. The confidentiality impact is rated High (complete access to accessible data), with no integrity or availability impact. The EPSS score of 0.03% (9th percentile) is very low, suggesting negligible observed exploitation activity in the wild. SSVC corroborates this: exploitation status is 'none,' the vulnerability is not automatable (likely due to the authentication requirement), and technical impact is assessed as 'partial.' KEV status is absent. Taken together, these signals indicate a medium-priority vulnerability in a specialized financial services platform - real but not an emergency for most defenders. The discrepancy between the 'Authentication Bypass' tag and PR:L in the CVSS vector warrants verification: if the bypass allows privilege escalation from low to a higher role, real-world impact may exceed the base CVSS score.

An attacker who possesses a low-privilege OFSAAI user account - obtained via phishing, credential stuffing, or insider access - sends crafted HTTP requests to the OFSAAI Platform component, exploiting the authorization bypass to retrieve data beyond their permitted access tier. Because no public exploit code has been identified, exploitation currently requires manual crafting of requests targeting the specific data exposure condition in the Platform layer.