What is the CVSS score of CVE-2026-61220?

CVE-2026-61220 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Banking Origination CVE-2026-61220

EUVD-2026-47418 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-hw25-crrj-25jf

Authentication Bypass Oracle Banking Origination

6.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-delivered HTTP attack requiring victim interaction with scope change and low C/I impact is consistent with the vendor-provided vector; independently assessed as accurate.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:14 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Banking Origination product of Oracle Financial Services Applications (component: Configuration). The supported version that is affected is 14.5.0.16.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking Origination. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Banking Origination, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Banking Origination accessible data as well as unauthorized read access to a subset of Oracle Banking Origination accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

AnalysisAI

Client-side injection in Oracle Banking Origination 14.5.0.16.0's Configuration component allows unauthenticated remote attackers over HTTP to read a subset of accessible banking origination data and perform unauthorized data modifications when a legitimate user interacts with a crafted payload. The CVSS scope change (S:C) confirms exploitation can cascade beyond the primary application into other Oracle Financial Services components sharing the same deployment context. Disclosed in Oracle's Critical Patch Update July 2026 with no confirmed active exploitation or public exploit code at time of analysis.

Technical ContextAI

The vulnerability resides in the Configuration component of Oracle Banking Origination 14.5.0.16.0, part of the Oracle Financial Services Applications suite used by banks to manage loan and credit origination workflows. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is the canonical fingerprint of a client-side injection vulnerability - most consistent with reflected or stored cross-site scripting (XSS) - where unsanitized input delivered over HTTP is rendered in a victim's browser. No CWE was assigned by Oracle, leaving the root cause class unconfirmed. The EUVD tag 'Authentication Bypass' likely refers to a post-exploitation consequence (e.g., session token theft enabling authentication impersonation) rather than a direct server-side authentication bypass, which would be inconsistent with the low C/I/A:N impact profile. The scope change indicates the attack context crosses trust boundaries, affecting Oracle Financial Services ecosystem components co-deployed with Oracle Banking Origination.

RemediationAI

Apply the patch issued in Oracle's Critical Patch Update for July 2026, referenced at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched version identifier is not specified in available references and must be confirmed via Oracle's support portal or My Oracle Support for the 14.5.0.16.0 patch bundle. As a compensating control prior to patching, restrict access to the Oracle Banking Origination Configuration component to trusted internal network segments and authenticated administrative roles, reducing exposure of the HTTP endpoint to untrusted users. If an application delivery controller or WAF is deployed in front of the application, enable XSS filtering rules targeting the Configuration component path to intercept crafted payloads before they reach end users. Additionally, implement strict Content Security Policy headers at the web tier to constrain script execution origins, limiting the blast radius of any client-side injection if triggered. Note that WAF and CSP controls are mitigations only and do not substitute for the vendor patch.