This vulnerability affects Oracle Banking Trade Finance (component: Infrastructure) in versions 14.6.0 through 14.8.0. It is exploitable remotely over the network via HTTP by an attacker with low privileges and no user interaction required. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Banking Trade Finance. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no availability impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation level for this specific issue.

Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Banking Trade Finance, as well as unauthorized access to all data accessible by the product. This compromises both confidentiality and integrity of sensitive financial data, potentially leading to significant business and operational risks. There is no reported impact on availability. No known exploits in the wild have been reported as of the advisory date.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities including this one. However, the advisory does not explicitly confirm patch availability or remediation status for CVE-2026-61105. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply all relevant security patches promptly. Until a patch is confirmed and applied, restrict network access to Oracle Banking Trade Finance interfaces to trusted users only and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.