Financial Services Analytical Applications Infrastructure vulnerabilities

11 known vulnerabilities in Financial Services Analytical Applications Infrastructure from Oracle. 11 are rated high or critical, and 3 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Oracle Financial Services Analytical…: Improper Access Control

  CVE-2026-34310Apr 21, 2026Oracle

  Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Easily exploitable vulnerabili

• 7.5 High severity

  Oracle Financial Services Analytical…: Improper Access Control

  CVE-2026-22010Apr 21, 2026Oracle

  Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Easily exploitable vulnerabili

• 7.5 High severity

  Oracle Financial Services Analytical…: Missing Authentication for Critical Functionality

  CVE-2025-61756Oct 21, 2025Oracle

  Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: System Configuration). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Easily exploitable

• 8.1 High severity

  Oracle Financial Services Analytical…: Missing Authorization

  CVE-2025-61751Oct 21, 2025Oracle

  Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Easily exploitable vulnerabili

• 9.8 Critical severity

  Oracle Financial Services Analytical…: Missing Authentication for Critical Functionality

  CVE-2025-53037Oct 21, 2025Oracle

  Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Easily exploitable vulnerabili

• 8.6 High severity

  Oracle Financial Services Analytical…: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2025-53036Oct 21, 2025Oracle

  Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Easily exploitable vulnerabili

• 7.4 High severity

  Financial Services Analytical Applications…: Improper Access Control

  CVE-2023-21901Jan 16, 2024Oracle

  Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 8.0.7, 8.0.8, 8.0.9, 8.1.0, 8.1.1 and 8.1.2. Easily ex

• 9.8 Critical severity

  Spring Framework JDK 9+ Remote Code Execution Exploited

  CVE-2022-22965Apr 1, 2022Spring FrameworkEPSS 99.6%

  A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot

• 9.8 Critical severity

  VMware Tanzu Spring Cloud Function Remote Code Execution Exploited

  CVE-2022-22963Apr 1, 2022Spring Cloud FunctionEPSS 99.9%

  In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local r

• 7.5 High severity

  ckeditor4: Inefficient Regular Expression Complexity

  CVE-2022-24729Mar 16, 2022CkeditorEPSS 2.49%

  CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significan

• 8.1 High severity

  Apache Tomcat Remote Code Execution Exploited

  CVE-2017-12617Oct 4, 2017ApacheEPSS 100%

  When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file