This vulnerability affects Oracle Banking Origination component Configuration in version 14.5.0.16.0. It allows an unauthenticated attacker with network access via HTTP to compromise the product by leveraging required human interaction from a third party. Successful exploitation can lead to unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of data. The vulnerability has a CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, low confidentiality and integrity impact, and no availability impact. The vulnerability may also affect additional Oracle products due to scope change. No official patch or remediation level is specified in the advisory, and no known exploits in the wild have been reported. Oracle's Critical Patch Update advisory for July 2026 references this vulnerability but does not explicitly confirm patch availability for Oracle Banking Origination; it recommends applying patches promptly for supported versions.

An unauthenticated attacker with network access can exploit this vulnerability by inducing a user to interact, resulting in unauthorized modification (update, insert, delete) and partial unauthorized reading of Oracle Banking Origination data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope change indicates potential impact on additional Oracle products beyond Oracle Banking Origination. There are no known exploits in the wild at this time.

Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or provide a specific remediation level for Oracle Banking Origination. Customers are strongly advised to remain on actively supported versions and apply Oracle Critical Patch Updates promptly once available. Until official patches or mitigations are confirmed, organizations should follow Oracle's guidance and monitor the vendor advisory for updates. No vendor advisory states that no action is required or that the issue is already mitigated.