This vulnerability affects Oracle Banking Trade Finance infrastructure component in versions 14.6.0 to 14.8.0. It permits a low privileged attacker with network access via HTTP to perform unauthorized actions such as creating, deleting, or modifying critical data. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vulnerability is identified as CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references this product among many others but does not explicitly confirm a patch or remediation level for this CVE. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Banking Trade Finance, as well as unauthorized access to all accessible data. This compromises confidentiality and integrity of the data but does not impact availability. The vulnerability allows a low privileged attacker with network access to cause significant data compromise.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others but does not explicitly state a patch or remediation level for CVE-2026-61105. Patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends customers remain on actively-supported versions and apply security patches without delay once available.