CVE-2026-22010

CVE-2026-22010 is a critical authentication bypass vulnerability affecting Oracle Financial Services Analytical Applications Infrastructure versions 8.0.7.9, 8.0.8.7, and 8.1.2.5. The flaw allows unauthenticated attackers to gain unauthorized access to sensitive financial data through the HTTP protocol without requiring valid credentials. This vulnerability impacts the Platform component of Oracle Financial Services Applications and poses significant risk to organizations relying on these analytical systems for financial operations. The vulnerability carries a CVSS 3.1 base score of 7.5 (HIGH), with an attack vector rated as network-accessible and exploitable with low complexity. No user interaction or elevated privileges are required for exploitation, making the attack highly practical. The primary impact is confidentiality compromise, potentially exposing complete access to all data within the analytical applications infrastructure, though integrity and availability are not directly affected. Current exploitation status indicates minimal immediate threat based on available indicators. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog, and the EPSS score of 0.000320 suggests very low probability of active exploitation in the wild. However, the moderate FAUCET risk score of 38.0 warrants timely patching, particularly given the ease of exploitation and the sensitivity of financial data at risk.