This vulnerability affects Oracle Banking Corporate Lending Process Management versions 14.5.0.0.0 through 14.9.0.0.0. It is exploitable remotely over the network via HTTP by an attacker with low privileges, but requires user interaction from a third party. Successful exploitation can lead to full takeover of the affected product, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, indicating network attack vector, high attack complexity, low privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle’s September 2026 Critical Security Patch Update includes fixes for this vulnerability. No known exploits in the wild have been reported.

Successful exploitation can result in complete compromise of Oracle Banking Corporate Lending Process Management, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the product, potentially leading to unauthorized access and control over sensitive banking processes.

Oracle has released patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches without delay. Oracle recommends remaining on actively-supported versions and promptly applying all security patches to mitigate this and other vulnerabilities. No alternative mitigations or workarounds are specified in the advisory.