PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8302 Oracle CVE debrief

CVE-2016-8302 is an Oracle FLEXCUBE Universal Banking information-disclosure issue affecting multiple supported releases. Oracle and NVD describe a low-privileged, network-accessible HTTP attack path that can expose a subset of accessible data, with no integrity or availability impact listed.

Vendor
Oracle
Product
Flexcube Universal Banking
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-27
Original CVE updated
2026-05-13
Advisory published
2017-01-27
Advisory updated
2026-05-13

Who should care

Oracle FLEXCUBE Universal Banking administrators, application security teams, and incident responders responsible for supported Oracle Financial Services Applications deployments, especially systems reachable over HTTP and used by users with lower privilege.

Technical summary

NVD lists this as CVSS 3.0 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) with CWE-200. Affected CPEs include Oracle FLEXCUBE Universal Banking versions 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, and 12.2.0. The reported impact is unauthorized read access to a subset of accessible data.

Defensive priority

Medium. The issue is confidentiality-only and requires low privileges, but it is network reachable and can expose application data. Prioritize if the product is internet-facing or handles sensitive banking information.

Recommended defensive actions

  • Confirm whether any affected Oracle FLEXCUBE Universal Banking versions are in use, including 11.3.0 through 12.2.0.
  • Review Oracle's January 2017 Critical Patch Update reference for applicable remediation guidance.
  • Restrict HTTP exposure to trusted networks and reduce access paths where possible.
  • Limit low-privilege account scope and review whether exposed data can be minimized through configuration or access controls.
  • Monitor for unusual read-only access patterns and audit application logs for data-access anomalies.
  • Plan upgrade or patch deployment in line with Oracle's supported remediation guidance for the affected version.

Evidence notes

The NVD record for CVE-2016-8302 lists the CVSS 3.0 vector, CWE-200, and the affected Oracle FLEXCUBE Universal Banking CPEs. The record references Oracle's January 2017 CPU advisory, SecurityFocus BID 95554, and SecurityTracker 1037636. The CVE was published on 2017-01-27 and the NVD record was modified on 2026-05-13; that modified date is metadata, not the vulnerability date. No KEV entry is provided in the supplied corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-8302 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-8302

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-8302 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-8302

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.