This vulnerability affects the User Interface component of Oracle Financial Services Transaction Filtering version 8.1.2.8.0. It allows an unauthenticated attacker to exploit the system remotely over HTTP without any privileges or user interaction, resulting in unauthorized access to sensitive data. The CVSS 3.1 base score is 7.5, reflecting a high impact on confidentiality. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's April 2026 Critical Patch Update advisory mentions a broad set of patches but does not explicitly confirm a fix for this product version or vulnerability in the provided content.

Successful exploitation can lead to unauthorized disclosure of critical data or complete access to all data accessible by Oracle Financial Services Transaction Filtering. There is no impact on data integrity or system availability reported. The vulnerability is remotely exploitable without authentication, increasing the risk of data compromise if the affected version is exposed to untrusted networks.

Oracle's April 2026 Critical Patch Update advisory references multiple patches across products but does not explicitly confirm a patch for this vulnerability or affected version in the provided content. Patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpuapr2026.html for the latest remediation guidance. Customers are strongly advised to remain on actively supported versions and apply Critical Patch Updates promptly once available. Until a patch is confirmed, restrict network access to the affected service to trusted users only.