This vulnerability affects the Oracle Banking Trade Finance product within Oracle Financial Services Applications, specifically versions 14.6.0 to 14.8.0. It is an easily exploitable network vulnerability requiring low privileges and no user interaction. Successful exploitation can result in unauthorized creation, deletion, or modification of critical or all accessible data within the product. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts. The vendor advisory references a Critical Patch Update released in July 2026 but does not explicitly confirm a patch for this specific vulnerability. Customers are urged to apply available patches promptly and remain on supported versions.

The vulnerability allows attackers with low privileges and network access via HTTP to gain unauthorized access to critical data, including the ability to create, delete, or modify such data within Oracle Banking Trade Finance. This compromises the confidentiality and integrity of the data but does not impact availability. The potential impact is significant given the critical nature of the data handled by this financial application.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly and remaining on actively supported versions. Until a specific patch is confirmed, restrict network access to Oracle Banking Trade Finance instances and monitor for unusual activity consistent with unauthorized data manipulation.