CVE-2025-50075
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Vulnerability in Oracle Financial Services Revenue Management and Billing (component: Security Management System) affecting versions 2.9.0.0.0–7.2.0.0.0. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data or all data accessible in the application.
Risk Assessment
Low barrier for the attacker (only low privileges required) combined with high confidentiality impact — potential leakage of financial and billing data. This may lead to regulatory violations and reputational damage.
Recommendation
Immediately apply Oracle patches for Revenue Management and Billing. Enforce least-privilege principles and monitor for unusual HTTP requests to the system.
Other vulnerabilities in Oracle Financial Services Revenue Management and Billing
Original NVD description (English source)
Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Security Management System). Supported versions that are affected are 2.9.0.0.0-7.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Revenue Management and Billing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Financial Services Revenue Management and Billing accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS