A remote attacker who can reach the Oracle Financial Services Analytical Applications Infrastructure application over HTTP can exploit a vulnerability that does not require any authentication. Exploitation gives the attacker access to confidential data housed in the environment, potentially allowing full read access to all data that the instance is allowed to serve. The weakness is due to improper access control (CWE‑284), reflected in a CVSS 3.1 score of 7.5, with a high confidentiality impact and no impact to integrity or availability.

Oracle Financial Services Analytical Applications Infrastructure for the Platform component. The versions affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. These are the supported releases listed by Oracle as vulnerable.

The vulnerability is exploitable over a network link via ordinary HTTP traffic, with no user interaction or special privileges required. The CVSS score of 7.5 signals a high-risk exposure, and the EPSS score of < 1% indicates a very low exploitation probability. The lack of a KEV listing does not diminish the likelihood of exploitation by malicious actors. The likely attack vector is a remote connection to the application’s HTTP endpoint.