Oracle Banking Trade Finance CVE-2026-61102

Exploitation requires network reachability to the Oracle Banking Trade Finance HTTP interface (Infrastructure component) and a valid low-privileged application account (CVSS PR:L) - it is not fully unauthenticated. No user interaction, no elevated privileges, and no non-default configuration are stated as required, and attack complexity is low (AC:L), so any authenticated low-privilege user can trigger it against affected versions 14.6.0-14.8.0. Limiting factors: the attacker must first obtain at least minimal credentials and must reach the HTTP endpoint, which is typically network-restricted in production banking deployments; note the vendor 'Authentication Bypass' tag may imply the true privilege barrier is weaker than PR:L - verify against the Oracle July 2026 CPU.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) indicates an easily exploitable, network-reachable flaw needing only a low-privileged account and no user interaction, yielding full read and write access to all application-accessible data - a serious signal for a core banking system. However, several risk-amplifying signals are missing: no EPSS score was provided, the vulnerability is not in CISA KEV, and no public POC is referenced, so there is no evidence of active or automated exploitation. The realistic risk is therefore high-impact but currently unproven in the wild: exploitation requires an existing (even minimally privileged) account, which narrows the attacker population to insiders or those who have already obtained credentials, tempering the raw 8.1 score. The vendor's 'Authentication Bypass' tag is somewhat in tension with the PR:L metric - if authentication can truly be bypassed the effective privilege requirement could be lower than stated; this discrepancy should be verified against the Oracle CPU July 2026 advisory.

An attacker who holds or phishes a low-privileged Trade Finance user account authenticates to the application's HTTP interface and issues crafted requests that bypass authorization checks in the Infrastructure component, reading and altering trade finance records such as letters of credit or account data belonging to other users or the whole tenant. No user interaction or elevated privileges are needed, so a single compromised junior operator credential is sufficient to exfiltrate or tamper with critical banking data. No public POC is referenced at time of analysis.