Oracle Financial Services Customer Screening EUVD-2026-24422

Exploitation requires network HTTP reachability to the Oracle Financial Services Customer Screening User Interface component of an instance running version 8.1.2.8.0; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no authentication, user-interaction, or special-configuration prerequisites - remote unauthenticated exploitation is possible against the affected version's exposed UI. Limiting factors: the target must be running the specific affected build 8.1.2.8.0, the User Interface must be network-accessible to the attacker (deployments that isolate the UI behind VPN/internal-only networks are far less exposed), and impact is confined to reading data (no write or denial-of-service via this flaw). No public exploit is currently available, which further limits real-world exploitation.

The signals are mixed but internally consistent toward 'real but not urgent.' The CVSS 3.1 base score is 7.5 (High) driven purely by confidentiality (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning trivial remote unauthenticated access with no user interaction - an easy attack if a working technique existed. Countering that, EPSS is only 0.03% (9th percentile), the vulnerability is not in CISA KEV, and the CISA SSVC framework rates Exploitation as 'none' with Technical Impact 'partial' (though Automatable 'yes'). So while the attack barrier is low on paper, there is no evidence of a public exploit or active exploitation. The 'partial' technical impact aligns with confidentiality-only loss rather than full system compromise. Net: this is a legitimate patch-soon issue for organizations running the affected version - especially given the sensitive AML/screening data involved - but not a drop-everything emergency absent exploit code. Note a minor tension worth verifying with the vendor: the description phrases outcomes as 'unauthorized access to critical data or complete access to all... accessible data,' which is broad, while CWE-285/'Authentication Bypass' tags suggest a specific access-control bypass path rather than generic data exposure.

An attacker who can reach the Customer Screening web interface over HTTP sends crafted requests to the User Interface component that bypass the intended authorization checks, returning sensitive screening/customer data without any login. No user interaction or credentials are required, so the request can be issued directly from any network position with connectivity to the host. No public proof-of-concept was identified at time of analysis, which currently limits practical exploitation.