CVE-2026-61220

Awaiting Analysis Awaiting Analysis - Queue

Oracle Banking Origination Configuration Vulnerability

Publication date: 2026-07-21

Last updated on: 2026-07-22

Assigner: Oracle

Description

Vulnerability in the Oracle Banking Origination product of Oracle Financial Services Applications (component: Configuration). The supported version that is affected is 14.5.0.16.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking Origination. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Banking Origination, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Banking Origination accessible data as well as unauthorized read access to a subset of Oracle Banking Origination accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-22

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-61220

EUVD

EUVD-2026-47418

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	banking_origination	14.5.0.16.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Banking Origination (version 14.5.0.16.0) that allows an unauthenticated attacker to access and modify some data remotely via HTTP. It requires user interaction and could impact other connected products. The attack can lead to unauthorized data reads, updates, inserts, or deletes.

Detection Guidance

Detecting this vulnerability requires checking for Oracle Banking Origination version 14.5.0.16.0 and monitoring HTTP network traffic for unauthorized access attempts. Use Oracle's official tools like Oracle Enterprise Manager or database logs to inspect for suspicious activity. Network scans with tools like Nmap can identify vulnerable versions running on systems.

Impact Analysis

If exploited, attackers could steal, alter, or delete sensitive banking data. This may lead to financial fraud, data breaches, or compliance violations. The impact depends on the data processed by Oracle Banking Origination in your environment.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy). Organizations using this software may face legal penalties, fines, or reputational damage if exploited.

Mitigation Strategies

Apply the latest security patches from Oracle immediately. Restrict HTTP access to Oracle Banking Origination systems using firewalls or network segmentation. Enable authentication for all administrative interfaces and monitor logs for unusual activity. Consider disabling the vulnerable component if not in use.

Hi! I’m here to help you understand CVE-2026-61220. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70