CVE-2018-3038: Vulnerability in the Oracle Banking Corporate Lending component of Oracle Financial Services Applications (...

Security readout for executives and security teams

This flaw can let an unauthenticated network attacker read some data from Oracle Banking Corporate Lending over HTTP. The known impact is confidentiality loss, not data modification or service outage. It matters most for banks or finance teams running the listed versions, especially where the application is reachable beyond tightly controlled networks. Exposure is likely limited to organizations operating affected Oracle Banking Corporate Lending versions. Risk increases when HTTP access to the application is available from untrusted networks. Internal-only systems are still exposed to unauthenticated users who can reach the application over the network. Treat this as a moderate-priority confidentiality issue for affected banking environments. It does not indicate known active exploitation in the provided sources, but the unauthenticated HTTP attack path makes timely vendor remediation and network exposure review important. Mitigation focus: Review Oracle July 2018 CPU guidance for CVE-2018-3038 and apply applicable vendor remediation.; Restrict HTTP access to Oracle Banking Corporate Lending to trusted networks only.; Inventory all affected versions: 12.3.0, 12.4.0, 12.5.0, 14.0.0, and 14.1.0..

Prepared

Jun 7, 2026, 13:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.