PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8323 Oracle CVE debrief

CVE-2016-8323 is a medium-severity Oracle FLEXCUBE Core Banking vulnerability affecting supported versions 5.1.0, 5.2.0, and 11.5.0. According to the CVE record, a low-privileged attacker with network access via HTTP could compromise the application and gain unauthorized read access to some data, as well as unauthorized update, insert, or delete access to some accessible data.

Vendor
Oracle
Product
CVE-2016-8323
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-27
Original CVE updated
2026-05-13
Advisory published
2017-01-27
Advisory updated
2026-05-13

Who should care

Oracle FLEXCUBE Core Banking administrators, financial institutions running the affected releases, IAM and application security teams, and incident responders responsible for customer-facing banking platforms.

Technical summary

The NVD record maps this issue to CWE-284 (improper access control) and assigns CVSS 3.0 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (base score 5.4). The published description says the issue is easily exploitable over HTTP by a low-privileged attacker, with impact limited to confidentiality and integrity of some accessible data. The affected CPEs in the record are Oracle FLEXCUBE Core Banking 5.1.0, 5.2.0, and 11.5.0.

Defensive priority

Medium. The issue is network-reachable and can affect data integrity and limited confidentiality, but the provided data does not indicate known exploitation, KEV listing, or ransomware use.

Recommended defensive actions

  • Identify whether Oracle FLEXCUBE Core Banking 5.1.0, 5.2.0, or 11.5.0 is deployed anywhere in the environment.
  • Apply Oracle's January 2017 CPU or a later vendor-supplied fix referenced by the advisory.
  • Limit exposure of the application over HTTP to only trusted administrative and business networks.
  • Review low-privilege roles and authorization paths for unintended data read/write capability.
  • Monitor for unexpected inserts, updates, deletes, and unusual read access against FLEXCUBE data.
  • Validate any compensating controls against Oracle's advisory and internal change-management procedures.

Evidence notes

All claims are taken from the supplied NVD record and its referenced Oracle advisory metadata. The record states affected versions 5.1.0, 5.2.0, and 11.5.0; the CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N; and the weakness classification is CWE-284. The provided reference list includes Oracle's January 2017 CPU advisory as a patch/vendor reference, plus SecurityFocus and SecurityTracker entries. No KEV entry or ransomware campaign is present in the supplied data.

Official resources

Publicly disclosed in the CVE/NVD record on 2017-01-27; the NVD entry was last modified on 2026-05-13. The supplied data references Oracle's January 2017 CPU advisory as the vendor patch source.