The flaw exists in the user interface component of Oracle Financial Services Transaction Filtering and allows an attacker with no credentials to exploit the product over an HTTP interface. Successful exploitation permits the adversary to read or retrieve any data that the application exposes, effectively breaking confidentiality for all information accessible through the system. This impact is reflected in a CVSS v3.1 score of 7.5, indicating a high potential for data disclosure when the vulnerability is harnessed.

Oracle Corporation’s Oracle Financial Services Transaction Filtering, version 8.1.2.8.0, is the only release explicitly flagged as vulnerable. Any installation running this version should be treated as affected until the vendor’s fix is applied.

The CVSS base score of 7.5 demonstrates that an attacker can mount the attack with minimal effort—only network reachability to the HTTP endpoint is required, and no authentication is needed. Although the EPSS score is not provided, the absence of a KEV listing does not diminish the urgency of protection, because the combination of a low attack effort and severe confidentiality impact makes exploitation attractive to threat actors. Network segmentation or firewalls that deny untrusted hosts from contacting the UI interface can mitigate the practical risk, but the definitive countermeasure is the vendor’s patch.