SB2026042214 - Multiple vulnerabilities in Oracle Financial Services Model Management and Governance

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026042214

SB2026042214 - Multiple vulnerabilities in Oracle Financial Services Model Management and Governance

Published: April 22, 2026

Security Bulletin ID SB2026042214
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Improper validation of certificate with host mismatch (CVE-ID: CVE-2025-68161)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to the Socket Appender does not perform TLS hostname verification of the peer certificate, even when the "verifyHostName" configuration attribute or the "log4j2.sslVerifyHostName"  system property is set to true. A remote attacker can perform MitM attack and intercept or redirect the log traffic. 


2) Out-of-bounds write (CVE-ID: CVE-2025-27821)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to crash the application.

The vulnerability exists due to a boundary error in the URI parser within the HDFS native client. A local user can pass a specially crafted URI to the application and perform a denial of service attack. 


Remediation

Install update from vendor's website.

References