PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5614 Oracle CVE debrief

CVE-2016-5614 is an information disclosure vulnerability in Oracle FLEXCUBE Private Banking’s Product / Instrument Search component. Oracle states that a low-privileged attacker with network access via HTTP could use the flaw to obtain unauthorized read access to a subset of accessible data in affected releases.

Vendor
Oracle
Product
CVE-2016-5614
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-27
Original CVE updated
2026-05-13
Advisory published
2017-01-27
Advisory updated
2026-05-13

Who should care

Organizations running Oracle FLEXCUBE Private Banking 2.0.1, 2.2.0, or 12.0.1, especially teams responsible for banking application security, access control, and patch management.

Technical summary

NVD classifies the issue as CWE-200 with CVSS v3.0 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating a network-reachable confidentiality issue with no integrity or availability impact. The affected CPEs listed by NVD are Oracle FLEXCUBE Private Banking 2.0.1, 2.2.0, and 12.0.1. The Oracle CPU for January 2017 is listed as the vendor advisory reference.

Defensive priority

Medium: prioritize remediation on any exposed FLEXCUBE Private Banking deployments because the issue is remotely reachable and can expose sensitive data, but it is not rated as a code-execution or availability-impacting flaw in the supplied record.

Recommended defensive actions

  • Verify whether Oracle FLEXCUBE Private Banking 2.0.1, 2.2.0, or 12.0.1 is deployed anywhere in the environment.
  • Apply the Oracle January 2017 CPU or later vendor-provided remediation for affected FLEXCUBE Private Banking instances.
  • Restrict network access to the application and review HTTP exposure of Product / Instrument Search endpoints.
  • Review application and access logs for unusual read-only activity against FLEXCUBE data.
  • Confirm least-privilege access controls for users who can reach the affected component.

Evidence notes

This debrief is based only on the supplied NVD record and linked official/vendor references. The record identifies affected versions 2.0.1, 2.2.0, and 12.0.1, describes unauthorized read access to a subset of accessible data, and assigns CVSS v3.0 4.3 with CWE-200. No KEV entry or ransomware campaign association was provided in the source corpus.

Official resources

CVE published on 2017-01-27; the supplied NVD record was later modified on 2026-05-13. Timing here reflects the published vulnerability record, not the later modification date.