PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8299 Oracle CVE debrief

CVE-2016-8299 is a medium-severity vulnerability in Oracle FLEXCUBE Universal Banking that was publicly recorded on 2017-01-27. According to NVD, it is an easily exploitable issue reachable over HTTP by a low-privileged attacker, and successful exploitation can lead to unauthorized read, insert, update, or delete access to some accessible data, along with partial denial of service.

Vendor
Oracle
Product
CVE-2016-8299
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-27
Original CVE updated
2026-05-13
Advisory published
2017-01-27
Advisory updated
2026-05-13

Who should care

Organizations running Oracle FLEXCUBE Universal Banking, especially banks and financial institutions using the affected Core component versions, plus teams responsible for application security, patching, and access control.

Technical summary

NVD lists affected Oracle FLEXCUBE Universal Banking versions 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, and 12.2.0. The CVSS v3.0 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L with a base score of 6.3. The primary weakness is CWE-284 (improper access control).

Defensive priority

Medium. Prioritize remediation for any exposed or widely used FLEXCUBE deployment, particularly where low-privileged application users or HTTP access could reach the affected component.

Recommended defensive actions

  • Verify whether any Oracle FLEXCUBE Universal Banking instance matches an affected version listed by NVD.
  • Review Oracle's January 2017 CPU advisory referenced by NVD and apply the vendor remediation for the affected release.
  • Restrict network exposure to the application and limit HTTP access to trusted users and management paths only.
  • Review low-privilege roles and permissions to ensure they cannot perform unauthorized data operations.
  • Monitor for unusual create, read, update, delete activity and service instability affecting FLEXCUBE.
  • If immediate patching is not possible, apply compensating controls and document the residual risk.

Evidence notes

This debrief is based only on the supplied NVD record and its referenced Oracle CPU Jan 2017 advisory entry. The affected versions, CVSS vector, severity, and CWE-284 come from the NVD metadata provided in the corpus. No exploit technique, exploit code, or unsupported remediation details are included.

Official resources

Publicly disclosed in the supplied NVD record on 2017-01-27. The record references Oracle's January 2017 CPU as the vendor advisory/patched reference. No KEV listing is present in the supplied data.