What is the CVSS score of CVE-2026-61102?

CVE-2026-61102 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Banking Trade Finance are affected by CVE-2026-61102?

Oracle Banking Trade Finance versions 14.6.0 through 14.8.0 contains a critical access-control flaw that allows network attackers with basic user privileges to read, modify, and delete all financial…

How to fix or mitigate CVE-2026-61102?

Within 24 hours: identify all systems running Oracle Banking Trade Finance versions 14.6.0 through 14.8.0 and immediately restrict network access to essential users and applications only; verify that HTTP access is disabled in favor of TLS-encrypted connections and enforce multi-factor authentication for all access. Within 7 days: conduct a comprehensive audit of data access logs for any suspicious or unauthorized read/modify/delete activity targeting financial records; implement or strengthen role-based access controls and the principle of least privilege for all Banking Trade Finance accounts; deploy or configure a Web Application Firewall to detect and block anomalous data access patterns such as bulk reads or unauthorized modifications. Within 30 days: establish formal monitoring of Oracle security advisories and develop a patching plan; if no vendor patch timeline is published, evaluate alternative solutions or plan temporary system isolation to minimize fraud and compliance exposure.

Oracle Banking Trade Finance CVE-2026-61102

EUVD-2026-47313 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-p5gx-9r5w-hr3g

Authentication Bypass Oracle Banking Trade Finance

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP with low complexity and a required low-privilege account gives AV:N/AC:L/PR:L/UI:N; full data read and write yields C:H/I:H, with no availability impact so A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:47 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 14.6.0-14.8.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Trade Finance. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Banking Trade Finance accessible data as well as unauthorized access to critical data or complete access to all Oracle Banking Trade Finance accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthorized data compromise in Oracle Banking Trade Finance versions 14.6.0 through 14.8.0 (Infrastructure component) allows a low-privileged, network-based attacker to read, create, modify, or delete all data accessible to the application over HTTP. Oracle rates this 8.1 (CVSS 3.1) with high confidentiality and integrity impact but no availability impact, and no user interaction required. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; the vendor's own 'Authentication Bypass' tag suggests weak access-control enforcement despite a nominal low-privilege requirement.

Technical ContextAI

The affected component is the Infrastructure layer of Oracle Banking Trade Finance, part of the Oracle Financial Services Applications (OFSA) suite used to automate international trade finance operations such as letters of credit, guarantees, and bills. The CWE is not assigned (N/A) in the source data, but the vendor-supplied tag 'Authentication Bypass' combined with the CVSS profile (network HTTP, low privilege, high confidentiality and integrity impact, scope unchanged) points to a broken access-control / improper-authorization class of flaw (conceptually CWE-285/CWE-639) in a web-facing HTTP interface, where an authenticated low-privilege account can reach data and operations beyond its authorization boundary. No specific CPE strings were provided in the intelligence; affected products are identified only by the Oracle product name and version range.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); the intelligence does not include an exact patched build number, so consult the CPU matrix for the specific patch level corresponding to your 14.6.0-14.8.0 deployment - patch available per vendor advisory, exact fixed version not independently confirmed here. Because exploitation requires a low-privileged authenticated session over HTTP, effective compensating controls until patching include restricting network access to the Trade Finance HTTP interface to trusted internal segments and VPN only (trade-off: may disrupt remote branch or partner connectivity), tightening role and least-privilege assignments to remove unnecessary low-privilege accounts, enforcing strong authentication and reviewing for any anonymous or default accounts given the 'Authentication Bypass' tag, and increasing audit logging on data create/modify/delete operations to detect abuse. Avoid relying on generic defense-in-depth alone; prioritize the vendor patch as the only complete fix.