CVE-2026-61097
A critical flaw in Oracle Banking Trade Finance Process Management lets an unauthenticated attacker with network access manipulate data and cause partial denial of service. The vulnerability requires the victim to interact with the attacker but can be triggered by a human other than the attacker. It affects versions 14.6.0 through 14.8.0.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Oracle Banking Trade Finance Process Management component of Oracle Financial Services Applications, versions 14.6.0 to 14.8.0, used by banks and financial institutions.
Real-world impact
An attacker could create, delete, or modify critical data, gain unauthorized access to sensitive information, or disrupt services by causing a partial denial of service.
Why this severity
The CVSS score of 9.6 reflects the vulnerability’s high confidentiality and integrity impact, the requirement for user interaction, and the fact that it can affect a wide scope of data. Availability is only partially impacted, which lowers the score slightly.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources