Oracle OFSAAI EUVD-2026-24412

The attacker must hold a valid, low-privileged account on the OFSAAI platform with network access over HTTP (PR:L, AV:N). High attack complexity (AC:H) means exploitation is not straightforward and requires specific preconditions to be met - likely a particular session state, request sequence, or race condition in the Platform component's access control logic, though the exact triggering condition is not specified in available data. Non-default or misconfigured deployment is not explicitly required. Exploitation is not automatable per SSVC, meaning scripted mass exploitation is unlikely. Limiting factors: valid credentials are required (not unauthenticated); the attacker must satisfy the AC:H constraint, which prevents trivial or scripted exploitation; and the vulnerability affects only versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 - organizations on other versions are not affected.

The CVSS 3.1 base score of 6.8 (Medium) masks a significant potential impact: C:H and I:H together mean a successful attacker can read or manipulate all financial data accessible to OFSAAI. However, AC:H meaningfully constrains real-world exploitability - exploitation requires satisfying specific preconditions beyond simple network access and authentication. EPSS at 0.03% (9th percentile) confirms no widespread exploitation has been observed. CISA SSVC rates exploitation as 'none' and automatable as 'no', consistent with the AC:H assessment and the absence of KEV listing. The SSVC 'total' technical impact rating aligns with the H/H confidentiality and integrity impact and reflects the critical sensitivity of financial data at stake. Cross-referencing these signals: this is a real vulnerability with serious potential consequences for financial institutions running affected versions, but the combination of required authentication, high attack complexity, and zero observed exploitation makes it a planned, patch-cycle priority rather than an emergency response item. No conflict between CVSS vector and description was identified.

An attacker holding a valid low-privileged OFSAAI account - such as a read-only analyst or contractor - sends a specially crafted HTTP request to the Platform component under specific session or timing conditions that satisfy the high-complexity requirement. The access control check fails to enforce authorization boundaries, granting the attacker read and write access to all financial data within OFSAAI, including risk models, transaction records, and compliance datasets. No public proof-of-concept has been identified, meaning an attacker would need to independently discover the specific triggering conditions.