CVE-2025-53036CWE-200information-disclosure

CVE-2025-53036

High · published October 22, 2025

CVSS v3.1
8.6
EPSS
0%
Percentile
34.4
In the wild
Unconfirmed
What it is

🚨 An unauthenticated HTTP request is all it takes to compromise Oracle Financial Services Applications! 🔥 Think of this vulnerability like a guest entering a secured bank vault without any identification. Once inside, they can access all the critical data without anyone batting an eye! An attacker could sneak into the Oracle Financial Services Analytical Applications Infrastructure and gain unauthorized access to sensitive data. The consequences could be absolutely devastating, leading to data breaches that compromise not just one application, but potentially a whole suite of Oracle products!

Put simply

Think of this vulnerability like a guest entering a secured bank vault without any identification. Once inside, they can access all the critical data without anyone batting an eye! This vulnerability allows an unauthenticated attacker with network access to bypass security checks in Oracle Financial Services Analytical Applications Infrastructure, resulting in unauthorized access to confidential data.

What to do

An attacker could sneak into the Oracle Financial Services Analytical Applications Infrastructure and gain unauthorized access to sensitive data. The consequences could be absolutely devastating, leading to data breaches that compromise not just one application, but potentially a whole suite of Oracle products! Patch to the latest versions beyond 8.0.8.7 and 8.1.2.5 immediately! Ensure that your firewall rules are tightened to limit HTTP access and regularly audit user permissions to safeguard sensitive data. 🛡️ You've got this! Take these steps, and you'll be on the path to securing your systems in no time! 💪✨

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00413 · 34.4th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2025-10-22T00:20Z
Affected products (3)
ProductVersionsFixed in
oracle/financial_services_analytical_applications_infrastructureall versions—
oracle/financial_services_analytical_applications_infrastructureall versions—
oracle/financial_services_analytical_applications_infrastructureall versions—
References (1)
EPSS history
Timeline
  • 21 OCT 20:02Z
    Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform)
    cvelistv5