{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35231", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "state": "PUBLISHED", "assignerShortName": "oracle", "dateReserved": "2026-04-01T20:03:40.833Z", "datePublished": "2026-04-21T20:35:44.694Z", "dateUpdated": "2026-04-21T20:35:44.694Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2026-04-21T20:35:44.694Z"}, "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Transaction Filtering. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Financial Services Transaction Filtering accessible data."}]}], "affected": [{"vendor": "Oracle Corporation", "product": "Oracle Financial Services Transaction Filtering", "versions": [{"version": "8.1.2.8.0", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:oracle:financial_services_transaction_filtering:8.1.2.8.0:*:*:*:*:*:*:*"}]}]}], "descriptions": [{"lang": "en-US", "value": "Vulnerability in the Oracle Financial Services Transaction Filtering product of Oracle Financial Services Applications (component: User Interface). The supported version that is affected is 8.1.2.8.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Transaction Filtering. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Financial Services Transaction Filtering accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)."}], "references": [{"url": "https://www.oracle.com/security-alerts/cpuapr2026.html", "name": "Oracle Advisory", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}]}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle Financial Services Transaction Filtering product of Oracle Financial Services Applications (component: User Interface). The supported version that is affected is 8.1.2.8.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Transaction Filtering. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Financial Services Transaction Filtering accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)."}], "id": "CVE-2026-35231", "lastModified": "2026-04-21T21:16:38.717", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "secalert_us@oracle.com", "type": "Primary"}]}, "published": "2026-04-21T21:16:38.717", "references": [{"source": "secalert_us@oracle.com", "url": "https://www.oracle.com/security-alerts/cpuapr2026.html"}], "sourceIdentifier": "secalert_us@oracle.com", "vulnStatus": "Received"}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T02:14:47.580111+00:00", "value": {"mitigation_remediation": ["Apply the official Oracle patch that fixes CVE-2026-35231 for Oracle Financial Services Transaction Filtering; if a patch is not yet released, upgrade to a newer supported version that includes the fix.", "Restrict external HTTP traffic to the product with firewall rules or network segmentation so that only trusted internal hosts can reach the UI interface.", "If the UI component is not required for your operations, disable or remove it from the deployment.", "Enable comprehensive logging for authentication and data access attempts and monitor logs for suspicious activity that may indicate exploitation."], "summary": {"action": "Patch immediately", "impact": "Confidentiality breach"}, "threat_synthesis": {"affected_systems": "Oracle Corporation\u2019s Oracle Financial Services Transaction Filtering, version 8.1.2.8.0, is the only impacted release listed. All installations of this product running the stated version should be considered vulnerable until patched.", "description_and_impact": "The vulnerability resides in the user interface component of Oracle Financial Services Transaction Filtering. An unauthenticated attacker that can reach the product over HTTP can exploit the flaw to read or retrieve all data accessible through the system, compromising confidentiality. The CVSS v3.1 score of 7.5 reflects the high impact on confidential data while the attack requires only network access and no authentication.", "risk_and_exploitability": "The CVSS base score of 7.5 indicates a moderate to high risk, and the absence of an EPSS score means current exploitation probability data is unavailable. Because the vulnerability is exploitable over a standard HTTP interface without credentials, the potential for unauthorized access is significant. The product is not listed in the CISA Known Exploited Vulnerabilities catalog, but the combination of low attack effort and high confidentiality impact warrants immediate remediation. Existing network segmentation or firewall controls that block untrusted hosts from reaching the HTTP endpoint can lower the practical risk."}}}}, "created": "2026-04-22T02:15:05.406414+00:00", "title": "Unauthenticated HTTP Access Leading to Confidential Data Exposure in Oracle Financial Services Transaction Filtering", "updated": "2026-04-22T02:15:05.406424+00:00", "vendors": [], "weaknesses": ["CWE-284", "CWE-200", "CWE-287"]}