CVE-2025-53037

The vulnerability classified as CWE-306 (Missing Authentication for Critical Function) means that critical functions of the Platform component are accessible without any authentication. An attacker with network access to the system can send HTTP requests directly to protected resources, bypassing access control mechanisms. No credentials or user interaction are required, making the attack fully automated.

Successful exploitation of this vulnerability leads to complete takeover of the Oracle Financial Services Analytical Applications Infrastructure system, including breach of confidentiality, integrity, and availability of data. Attackers can gain unauthorized access to sensitive financial and analytical data, modify it, and cause service unavailability (DoS).

Apply patches available from the vendor in accordance with references published as part of the Oracle Critical Patch Update from October 2025: https://www.oracle.com/security-alerts/cpuoct2025.html. Until the update is applied, it is recommended to restrict network access to the Platform component exclusively to trusted hosts at the firewall level and to monitor HTTP traffic directed to the system.

Oracle Financial Services Analytical Applications Infrastructure versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 (component: Platform).