CVE-2017-3297: Vulnerability in the Oracle FLEXCUBE Direct Banking component of Oracle Financial Services Applications (su...

Security readout for executives and security teams

CVE-2017-3297 affects Oracle FLEXCUBE Direct Banking, a financial-services banking platform. A low-privileged user with HTTP network access could gain unauthorized access to critical banking data or all data reachable through the application. Oracle rates exploitation as difficult, and the listed CVSS v3 score is 5.3. Exposure is most likely where Oracle FLEXCUBE Direct Banking 12.0.2 or 12.0.3 is still deployed and reachable over HTTP by authenticated low-privileged users. Internet, partner, branch, or internal banking portals should be prioritized for inventory. Treat this as a moderate-priority banking data confidentiality risk. It is not reported as actively exploited in the provided evidence, but affected systems handle sensitive financial data and should be verified, patched, and access-restricted promptly. Mitigation focus: Review Oracle’s January 2017 Critical Patch Update guidance for this CVE.; Patch or upgrade affected FLEXCUBE Direct Banking 12.0.2 and 12.0.3 deployments per Oracle guidance.; Limit HTTP access to trusted networks, VPNs, or approved application gateways..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.