CVE-2026-61220

MediumCVSS 6.1

Published: 21/07/2026(UTC)Updated: 19/08/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

7th percentile - higher than 7% of all known CVEs

Summary

Vulnerability in Oracle Banking Origination (Oracle Financial Services Applications) version 14.5.0.16.0. An unauthenticated attacker via HTTP, with user interaction, can gain unauthorized read and write access to some data, and the attack may impact other products (scope change).

Risk Assessment

An attacker could modify or read loan origination data and affect other banking systems, potentially leading to financial fraud.

Recommendation

Apply the Oracle patch. Restrict system access and educate users.

Other vulnerabilities in Oracle Financial Services Applications

CVE-2026-61105High
Vulnerability in Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). Affected versions 14.6.0-14.8.0. A low privileged attacker with network access via HTTP can compromise all data confidentiality and integrity.

Original NVD description (English source)

Vulnerability in the Oracle Banking Origination product of Oracle Financial Services Applications (component: Configuration). The supported version that is affected is 14.5.0.16.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking Origination. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Banking Origination, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Banking Origination accessible data as well as unauthorized read access to a subset of Oracle Banking Origination accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).