This vulnerability affects the Reports component of Oracle Banking Branch within Oracle Financial Services Applications. It is exploitable remotely over the network via HTTP by an attacker with low privileges. The attack requires user interaction from a third party, making exploitation more challenging. The vulnerability has a CVSS 3.1 base score of 8.0, indicating high impact on confidentiality, integrity, and availability. The scope of the vulnerability extends beyond Oracle Banking Branch, potentially affecting other Oracle products. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides targeted fixes for affected versions.

Successful exploitation can lead to complete takeover of Oracle Banking Branch, compromising confidentiality, integrity, and availability of the system. The vulnerability's scope change means that other Oracle products may also be significantly impacted. The attack requires network access and user interaction, limiting ease of exploitation but still posing a serious risk to affected environments.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to affected versions. Oracle recommends remaining on actively supported versions and applying security updates without delay to mitigate exploitation risks. No indication of alternative mitigations or 'no action required' was provided by the vendor advisory.