EUVD-2026-47308
GHSA-gcw7-hq6v-5f6g
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Unauthenticated network HTTP attack (AV:N/PR:N) but requires victim interaction (UI:R); browser-mediated flaw crosses a trust boundary (S:C) with high C/I and partial availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Banking Trade Finance Process Management product of Oracle Financial Services Applications (component: Common). Supported versions that are affected are 14.6.0-14.8.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking Trade Finance Process Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Banking Trade Finance Process Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Banking Trade Finance Process Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Banking Trade Finance Process Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Banking Trade Finance Process Management. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L).
AnalysisAI
Cross-context web attack against Oracle Banking Trade Finance Process Management (OBTFPM) 14.6.0 through 14.8.0 lets an unauthenticated network attacker who lures an authenticated user into interacting with crafted content act in the victim's session, reading, creating, deleting or modifying all OBTFPM-accessible data and causing a partial denial of service. Oracle rates it CVSS 3.1 9.6 with a scope change (S:C), meaning impact can spill into other connected products beyond OBTFPM itself. No public exploit is identified at time of analysis and it is not in CISA KEV; the Critical rating is driven by the scope change plus full confidentiality/integrity impact rather than by observed exploitation.
Technical ContextAI
OBTFPM is a web-based, workflow-driven trade-finance middle-office application in the Oracle Financial Services / Oracle Banking suite, typically deployed on WebLogic and fronting core banking data. The affected component is generically labeled 'Common', and Oracle assigns no CWE. The CVSS profile (AV:N, PR:N, UI:R, S:C) is the signature Oracle uses for browser-mediated flaws such as stored/reflected cross-site scripting or cross-site request forgery, where the server does not authenticate the attacker but a logged-in operator's browser executes attacker-influenced content, allowing actions to cross a trust/scope boundary into other systems the session can reach. Because the actual root-cause class is not published (CWE N/A), the specific injection point within the Common component cannot be confirmed from available data.
RemediationAI
Apply the Oracle Critical Patch Update for July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html), the vendor advisory covering this CVE; patch available per vendor advisory, though an exact fixed build number is not stated in the available data, so consult the CPU patch matrix for the precise patch for your 14.6.0/14.7.0/14.8.0 deployment. Until patched, reduce exposure of the browser-mediated attack by restricting OBTFPM's web UI to trusted internal networks or VPN, placing it behind a WAF with XSS/CSRF filtering, enforcing a strict Content-Security-Policy and anti-CSRF tokens at the reverse proxy, and training trade-finance operators not to open untrusted links while authenticated - with the trade-off that WAF rules can produce false positives against legitimate workflow submissions and network restriction may block remote branch users. Because exploitation needs operator interaction, tightening session timeouts and segregating OBTFPM sessions from general browsing on the same host further limits the window without altering application behavior.
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is po
XStream is software for serializing Java objects to XML and back again. Rated high severity (CVSS 8.8), this vulnerabili
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to ru
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20. Rated high severity (CVSS 7.4), this vul
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. Rated high severity (CVS
Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XM
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable h
In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. R
Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastr
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable h
A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file.0.22 and prior 2.0.x versions.
A carefully crafted PDF file can trigger an infinite loop while loading the file.0.22 and prior 2.0.x versions. Rated me
Same weakness CWE-284 – Improper Access Control
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today