PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8322 Oracle CVE debrief

CVE-2016-8322 is an information-disclosure issue in Oracle FLEXCUBE Core Banking, part of Oracle Financial Services Applications. According to NVD, the issue was published on 2017-01-27 and affects supported versions 5.1.0, 5.2.0, and 11.5.0. Oracle describes the vulnerability as easily exploitable by a low-privileged attacker with network access via HTTP, with successful exploitation resulting in unauthorized read access to a subset of accessible data.

Vendor
Oracle
Product
CVE-2016-8322
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-27
Original CVE updated
2026-05-13
Advisory published
2017-01-27
Advisory updated
2026-05-13

Who should care

Organizations running Oracle FLEXCUBE Core Banking in the affected versions should treat this as a security review item for internet-facing or broadly reachable deployments, especially where low-privilege application access is available.

Technical summary

NVD assigns CVSS v3.0 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, which matches a network-reachable confidentiality issue rather than an integrity or availability impact. The recorded weakness is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The affected CPEs in the source data are Oracle FLEXCUBE Core Banking 5.1.0, 5.2.0, and 11.5.0. The vendor advisory referenced by NVD is Oracle CPU January 2017.

Defensive priority

Medium. The issue is limited to confidentiality, but it is network-exploitable and requires attention if the affected product versions are still deployed.

Recommended defensive actions

  • Identify whether Oracle FLEXCUBE Core Banking 5.1.0, 5.2.0, or 11.5.0 is in use anywhere in the environment.
  • Review Oracle's January 2017 security advisory for the corresponding fix or mitigation guidance.
  • Prioritize patching or compensating controls on any exposed FLEXCUBE instances that accept HTTP access.
  • Restrict network access to FLEXCUBE administrative and user interfaces to trusted source networks only.
  • Audit access logs for unusual low-privilege requests against FLEXCUBE data-access endpoints.
  • Validate whether any exposed data could have been read by unauthorized users before remediation.

Evidence notes

This debrief is based on the supplied NVD record and linked references only. Key evidence includes the NVD CVSS vector (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), the CWE-200 weakness classification, the affected Oracle FLEXCUBE Core Banking CPE entries for versions 5.1.0, 5.2.0, and 11.5.0, and the Oracle CPU January 2017 vendor advisory referenced by NVD. The CVE published date used here is 2017-01-27 per the supplied timeline.

Official resources

Publicly disclosed via the CVE record on 2017-01-27; modified in NVD on 2026-05-13.