The Oracle Financial Services Analytical Applications Infrastructure flaw is an access control bypass that allows an attacker with low privileges and network access to the HTTP interface to create, delete, or modify critical data, and to read any data exposed by the system. The weakness manifests as an authorization bypass and a privilege escalation condition. Successful attacks can result in unauthorized modification of critical data or full access to all Oracle Financial Services Analytical Applications Infrastructure‑exposed data, leading to confidentiality and integrity losses.

Oracle Corporation’s Oracle Financial Services Analytical Applications Infrastructure is affected. Supported vulnerable versions are 8.0.7.9, 8.0.8.7, and 8.1.2.5. No other versions are indicated.

The CVSS score of 6.8 denotes a moderate risk, while the EPSS score of less than 1% indicates a very low probability that exploitation is occurring today. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is over the network via HTTP, requiring only low privileges. An attacker would send crafted requests to endpoints that lack proper authorization checks, thereby gaining unauthorized data operations across the infrastructure.