This vulnerability affects the Onboarding Batch Processes component of Oracle Banking Origination in versions 14.5.0.0.0 through 14.9.0.0.0. It is difficult to exploit but allows a low privileged attacker with network access via HTTP to compromise the system, potentially leading to full takeover. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability. Oracle has included a fix for this vulnerability in their September 2026 Critical Security Patch Update.

Successful exploitation can result in complete compromise of Oracle Banking Origination, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected application, potentially leading to unauthorized access and control over banking origination processes.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate this vulnerability. Oracle recommends staying on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.