Vulnerability Report

CVE-2026-22010

Title: Oracle Financial Services Data Confidentiality Vulnerability

Auth Bypass

Proof Of Concept

PoC Available for CVE-2026-22010

CWE Category NVD-CWE-noinfo

Published Date Apr 21, 2026

Modified Date Apr 23, 2026

Exploit Status Available

Score 7.5 CVSS v3.1

Exploit Probability (EPSS)

0.31%

Vulnerability Summary

CVE-2026-22010: Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Financial Services Analytical Applications Infrastructure accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Impacted Vendors

oracle 1

Reference Links

https://www.oracle.com/security-alerts/cpuapr2026.html

CVSS v3.1

Source Entity [email protected]

Severity HIGH

7.5

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-22010 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/George0Papasotiriou/CVE-2026-22010-Android-Intent-Redirection-to-Exported-Component

View Code

April 23, 2026 MODIFIED