This vulnerability affects the Reports component of Oracle Banking Branch within Oracle Financial Services Applications. It is exploitable remotely over the network via HTTP by an attacker with low privileges, but requires user interaction from a third party. Successful exploitation can lead to full compromise of the Oracle Banking Branch system. The CVSS 3.1 base score is 7.1, indicating high severity with high impact on confidentiality, integrity, and availability. The affected versions are from 14.5.0.0.0 up to and including 14.9.0.0.0. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides targeted security fixes for this and many other vulnerabilities.

If exploited, this vulnerability can result in complete takeover of the Oracle Banking Branch product, affecting confidentiality, integrity, and availability of the system. The attack requires network access via HTTP and user interaction from a person other than the attacker, making exploitation more difficult. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches promptly to mitigate this risk. Oracle recommends remaining on actively supported versions and applying patches without delay. No alternative mitigations or workarounds are specified in the advisory.