This vulnerability affects Oracle Banking Trade Finance Process Management component of Oracle Financial Services Applications, specifically versions 14.6.0 through 14.8.0. It is exploitable remotely over the network without authentication but requires user interaction from a third party. The vulnerability allows attackers to gain unauthorized creation, deletion, or modification access to critical data, full unauthorized access to all accessible data, and the ability to cause a partial denial of service. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L) indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high confidentiality and integrity impact with low availability impact. The vendor advisory is a general Critical Patch Update for July 2026, listing many products and versions but does not explicitly confirm a patch for this vulnerability. No known exploits in the wild have been reported.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Banking Trade Finance Process Management. Attackers may gain unauthorized access to all data accessible by the product and cause partial denial of service conditions. The vulnerability affects confidentiality, integrity, and availability with a critical severity rating (CVSS 9.6). The scope of impact may extend beyond the affected product to additional Oracle products.

Oracle has published a Critical Patch Update advisory for July 2026 that addresses multiple vulnerabilities across Oracle products. However, the advisory content provided does not explicitly confirm the availability of a patch for CVE-2026-61097. Customers should review the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. It is strongly recommended to apply all relevant security patches promptly and remain on actively supported versions. Until a patch is confirmed and applied, organizations should consider restricting network access to the affected Oracle Banking Trade Finance Process Management instances and monitor for suspicious activity requiring user interaction.