CVE-2026-22010 is a vulnerability affecting Oracle Financial Services Analytical Applications Infrastructure (versions 8.0.7.9, 8.0.8.7, and 8.1.2.5) that permits unauthenticated attackers with network access via HTTP to compromise the system. The vulnerability allows unauthorized access to critical or all accessible data within the product. It has a CVSS 3.1 base score of 7.5, reflecting a high severity due to the ease of exploitation (network attack vector, no privileges or user interaction required) and the confidentiality impact. Oracle has addressed this vulnerability in its April 2026 Critical Patch Update, which includes patches for multiple products and vulnerabilities. The advisory urges customers to apply patches promptly to mitigate risks. No direct exploit details or mitigation beyond patching are provided in the advisory.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data or complete access to all data accessible through Oracle Financial Services Analytical Applications Infrastructure. The impact is limited to confidentiality; integrity and availability are not affected according to the CVSS vector. This could result in significant data exposure within affected environments if exploited.

Oracle has released a Critical Patch Update in April 2026 that addresses this vulnerability among others. Customers should promptly apply the April 2026 Critical Patch Update to Oracle Financial Services Analytical Applications Infrastructure to remediate this vulnerability. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.