This vulnerability affects Oracle Banking Corporate Lending versions 14.5.0.0.0 through 14.9.0.0.0 and requires physical access to the communication segment connected to the hardware where the software executes. It is difficult to exploit but allows an unauthenticated attacker to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data. The vulnerability has a CVSS 3.1 score of 8.0 with attack vector 'Adjacent Network', high attack complexity, no privileges required, no user interaction, and scope change. The impact includes high confidentiality and integrity loss but no availability impact. Oracle’s September 2026 Critical Security Patch Update includes fixes for this vulnerability, and customers should consult Oracle support for patch availability and installation instructions.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Banking Corporate Lending, compromising confidentiality and integrity of sensitive information. The vulnerability also has a scope change, meaning it may impact additional Oracle products beyond the initially affected software. There is no reported impact on system availability. The attack requires physical access to the communication segment, making exploitation more difficult.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers using affected versions (14.5.0.0.0 through 14.9.0.0.0) should contact Oracle Support to obtain and apply the appropriate patches promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate exploitation risks. Since the vulnerability requires physical access to the communication segment, restricting such access can also reduce risk.