What is the CVSS score of CVE-2026-61105?

CVE-2026-61105 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Banking Trade Finance are affected by CVE-2026-61105?

Oracle Banking Trade Finance versions 14.6.0-14.8.0 contain an authenticated data compromise vulnerability enabling low-privileged users to read, modify, and delete all application-accessible…

How to fix or mitigate CVE-2026-61105?

Within 24 hours, inventory all systems running Oracle Banking Trade Finance 14.6.0-14.8.0 and document network access paths; enable comprehensive audit logging on the Infrastructure component to capture all data operations. Within 7 days, implement network segmentation restricting access to the affected systems to authorized personnel only, enforce multi-factor authentication for all application access, and configure network monitoring to flag suspicious data read or modification attempts. Within 30 days, contact Oracle support to confirm patch availability and timelines; if no patch is released, accelerate planning to upgrade to version 14.9.0 or later or migrate to an alternative patched solution; until patched, maintain maximum network restrictions around the vulnerable Infrastructure component.

Banking Trade Finance CVE-2026-61105

EUVD-2026-47316 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-3258-4hg6-phph

Authentication Bypass Oracle Banking Trade Finance

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:47 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 14.6.0-14.8.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Trade Finance. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Banking Trade Finance accessible data as well as unauthorized access to critical data or complete access to all Oracle Banking Trade Finance accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Banking Trade Finance 14.6.0 through 14.8.0 (Infrastructure component) allows a low-privileged, network-authenticated attacker to read, create, modify, or delete all data accessible to the application over HTTP. Rated CVSS 3.1 8.1 (C:H/I:H, no availability impact), this is an easily exploitable flaw requiring no user interaction, disclosed in the Oracle July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.