Banking Origination
Monthly
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Client-side injection in Oracle Banking Origination 14.5.0.16.0's Configuration component allows unauthenticated remote attackers over HTTP to read a subset of accessible banking origination data and perform unauthorized data modifications when a legitimate user interacts with a crafted payload. The CVSS scope change (S:C) confirms exploitation can cascade beyond the primary application into other Oracle Financial Services components sharing the same deployment context. Disclosed in Oracle's Critical Patch Update July 2026 with no confirmed active exploitation or public exploit code at time of analysis.
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Client-side injection in Oracle Banking Origination 14.5.0.16.0's Configuration component allows unauthenticated remote attackers over HTTP to read a subset of accessible banking origination data and perform unauthorized data modifications when a legitimate user interacts with a crafted payload. The CVSS scope change (S:C) confirms exploitation can cascade beyond the primary application into other Oracle Financial Services components sharing the same deployment context. Disclosed in Oracle's Critical Patch Update July 2026 with no confirmed active exploitation or public exploit code at time of analysis.