PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5509 Oracle CVE debrief

CVE-2016-5509 is a low-severity information disclosure issue in Oracle FLEXCUBE Investor Servicing. Oracle and NVD describe it as accessible to a low-privileged attacker with network access via HTTP, with successful exploitation resulting in unauthorized read access to a subset of accessible data. The NVD entry maps the issue to specific affected 12.x releases and rates it CVSS 3.0 3.1 (Low).

Vendor
Oracle
Product
CVE-2016-5509
CVSS
LOW 3.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-27
Original CVE updated
2026-05-13
Advisory published
2017-01-27
Advisory updated
2026-05-13

Who should care

Oracle FLEXCUBE Investor Servicing administrators, application owners, security teams, and network teams responsible for the affected 12.0.1, 12.0.2, 12.0.4, 12.1.0, and 12.3.0 deployments.

Technical summary

NVD describes the issue with CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating a network-reachable but relatively difficult-to-exploit confidentiality issue. The vulnerability is listed for Oracle FLEXCUBE Investor Servicing Core and affects confidentiality only; NVD does not assign a specific CWE beyond NVD-CWE-noinfo. The reported impact is unauthorized read access to a subset of data accessible to the application.

Defensive priority

Low

Recommended defensive actions

  • Check whether Oracle FLEXCUBE Investor Servicing is deployed in any affected 12.x release listed by NVD.
  • Apply Oracle's January 2017 CPU/security advisory reference for this product if the environment is still on an affected release.
  • Limit HTTP exposure to the application with network segmentation, access controls, and strong authentication where possible.
  • Review application and access logs for unusual data-read activity and confirm least-privilege access to the affected service.
  • Plan an upgrade or migration path away from unsupported or unmaintained affected versions.

Evidence notes

This debrief is based on the supplied NVD record for CVE-2016-5509 and its Oracle advisory references. The CVE was published on 2017-01-27T22:59:00.147Z, and the NVD record shows a later modification time of 2026-05-13T00:24:29.033Z; the published date is used as the issue date. The source corpus states affected versions are 12.0.1, 12.0.2, 12.0.4, 12.1.0, and 12.3.0, with CVSS v3.0 base score 3.1.

Official resources

CVE published by NVD on 2017-01-27. NVD later modified the record on 2026-05-13, which does not change the original CVE publication date.