This vulnerability affects Oracle Banking Trade Finance (component: Infrastructure) in versions 14.6.0 through 14.8.0. It allows a low privileged attacker with network access via HTTP to perform unauthorized actions such as creation, deletion, or modification of critical data, or gain unauthorized access to all accessible data within the product. The CVSS 3.1 base score is 8.1, indicating high severity with high confidentiality and integrity impacts and no impact on availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm a dedicated patch or remediation level for it. Customers should consult the advisory and apply relevant patches as soon as they become available.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full unauthorized access to all data accessible by Oracle Banking Trade Finance. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on system availability. The vulnerability is exploitable remotely over the network via HTTP by an attacker with low privileges, increasing the risk of compromise.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities, including this one. However, the advisory does not explicitly confirm the availability of a specific patch for CVE-2026-61102. Customers should monitor the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and apply updates promptly once released. Until then, no specific workaround or temporary fix is documented. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate exploitation risks.