This vulnerability affects the User Interface component of Oracle Financial Services Analytical Applications Infrastructure. It permits a low privileged attacker with network access via HTTP to compromise the system, contingent on human interaction by a third party. The CVSS 3.1 base score is 4.8, reflecting a medium severity with high confidentiality impact but no integrity or availability impact. The attack complexity is high, and user interaction is required. The vendor advisory references the April 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Customers are advised to apply Oracle's Critical Patch Updates without delay to address such vulnerabilities.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Financial Services Analytical Applications Infrastructure. The vulnerability does not impact data integrity or availability. Exploitation is difficult and requires user interaction, reducing the likelihood of automated or widespread attacks. There are no known exploits in the wild currently.

Patch status is not yet confirmed—check the Oracle April 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpuapr2026.html. Oracle recommends that customers remain on actively supported versions and apply Critical Patch Updates promptly. Since no explicit patch or workaround is stated for this vulnerability, following Oracle's general patching guidance is advised.