Oracle Banking OBTFPM CVE-2026-61097

Exploitation requires human interaction from a person other than the attacker (CVSS UI:R) - specifically an already-authenticated OBTFPM user must be induced to interact with attacker-supplied content (e.g., click a crafted link or view malicious content) while logged in; the attacker needs no OBTFPM credentials (PR:N) and only network HTTP access to the application (AV:N). Limiting factors: the mandatory victim interaction means this cannot be exploited fully autonomously, an active authenticated operator session must exist, and only supported versions 14.6.0-14.8.0 are affected. The scope change (S:C) means a successful attack can impact additional connected products beyond OBTFPM, raising blast radius even though the entry point is the OBTFPM web tier.

The signals are mixed and must be weighed rather than taken at face value. CVSS 3.1 is 9.6 (Critical), but that magnitude comes largely from the scope change (S:C) combined with C:H/I:H, not from trivial reachability: exploitation requires UI:R, so a human other than the attacker must be induced to interact - this is not a wormable, hands-off RCE. AV:N/AC:L/PR:N confirm no credentials and low complexity, but the mandatory user-interaction gate meaningfully lowers real-world exploitability versus a pure UI:N flaw. No EPSS score, no SSVC decision, and no KEV entry were provided, and no POC is referenced, so there is no evidence of automatable or in-the-wild exploitation - treat this as a high-priority patch for OBTFPM operators (banks) driven by data sensitivity, not as an emergency zero-day. Note a data conflict: the input tags include 'Authentication Bypass' and 'Denial Of Service', yet the CVSS vector shows only PR:N (no privilege needed) and A:L (partial DoS) - the 'Authentication Bypass' tag appears auto-generated and is not corroborated by the vector, which describes a user-interaction-dependent, scope-changing web attack; verify with Oracle before treating this as a true auth bypass.

An attacker crafts a malicious link or web page (or plants attacker-controlled content that OBTFPM renders) and, via phishing or a watering hole, gets an authenticated OBTFPM operator to open it in their browser while logged in. The victim's session then performs attacker-directed reads or changes to trade-finance records, and because of the scope change those actions can reach connected systems the session can access. No public exploit is identified at time of analysis, so this scenario is inferred from the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) rather than a demonstrated PoC.