[NEW] [high] Oracle Financial Services Applications: Multiple vulnerabilities

CSIRTS triage

What

Multiple vulnerabilities in Oracle Financial Services Applications allow remote attackers to compromise confidentiality, integrity, and availability.

Who is affected

Deployments of Oracle Financial Services Applications running affected versions accessible remotely or by authenticated users.

Urgency

High severity with no current exploitation; critical for financial institutions and sensitive data handling.

Action

Apply the latest Oracle Financial Services Applications security patches from Oracle's official updates.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

CERT-Bund (BSI) Security Advisories (DE · national-cert · site)

Severity

high

Published

2026-08-19

Exploitation

Not in CISA KEV at last sync

Language

Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2895

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-335570.68% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 50% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-339290.71% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 51% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-344810.69% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 50% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-418550.27% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 19% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-709220.48% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 40% of all EPSS-scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• unknownNCSC-2026-0312 [1.00] [M/H] Vulnerabilities resolved in Oracle Financial Servicesncsc-nl
• unknownNCSC-2026-0311 [1.00] [M/H] Vulnerabilities resolved in Oracle Enterprise Managerncsc-nl
• high[NEW] [high] Oracle Enterprise Manager: Multiple vulnerabilitiescert-bund
• high[NEW] [high] Oracle Hyperion: Multiple vulnerabilitiescert-bund
• high[NEW] [high] Oracle Supply Chain: Multiple vulnerabilitiescert-bund
• medium[NEW] [medium] Oracle Retail Applications: Vulnerability compromises integritycert-bund
• unknownMultiple vulnerabilities in Oracle MySQL (August 19, 2026)cert-fr-avis
• highCVE-2026-70922: Vulnerability in the Oracle Financial Services Enterprise Case Management product of Oracle Fi…nvd
• medium[UPDATE] [medium] Apache Kafka: Multiple vulnerabilitiescert-bund
• medium[UPDATE] [medium] Apache log4j: Multiple vulnerabilities allow file manipulationcert-bund
• high[UPDATE] [high] VMware Tanzu Spring Framework: Multiple vulnerabilitiescert-bund
• high[NEW] [high] Oracle Communications: Multiple vulnerabilitiescert-bund

Recent advisories for Oracle Financial Services Applications

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• highCVE-2026-70922: Vulnerability in the Oracle Financial Services Enterprise Case Management product of Oracle Fi…nvd · 2026-08-18
• high[NEW] [high] Oracle Financial Services Applications: Multiple vulnerabilitiescert-bund · 2026-07-22
• mediumCVE-2026-61220: Vulnerability in the Oracle Banking Origination product of Oracle Financial Services Applicati…nvd · 2026-07-21
• highCVE-2026-61105: Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applica…nvd · 2026-07-21
• highCVE-2026-61102: Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applica…nvd · 2026-07-21
• criticalCVE-2026-61097: Vulnerability in the Oracle Banking Trade Finance Process Management product of Oracle Financi…nvd · 2026-07-21

More from CERT-Bund (BSI) Security Advisories

• high[NEW] [high] Joomla: Multiple vulnerabilities2026-08-19
• medium[NEW] [medium] Axis Axis OS: Multiple vulnerabilities2026-08-19
• medium[NEW] [medium] CPython: Multiple vulnerabilities2026-08-19
• high[NEW] [high] Atlassian Products (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, and Jira): Multiple vulnera…2026-08-19
• high[NEW] [high] Microsoft Developer Tools: Multiple Vulnerabilities2026-08-19