Executive brief
Oracle Banking Origination is a core system used by financial institutions to manage customer account onboarding and loan origination workflows. A flaw in its Onboarding Batch Processes component allows a low-privileged user with network access to bypass authentication and gain complete control over the system, potentially compromising customer data and disrupting critical banking operations.
Technical details
This is a difficult-to-exploit authentication bypass or privilege escalation vulnerability in the Onboarding Batch Processes component of Oracle Banking Origination. The flaw allows a low-privileged, authenticated attacker to escalate privileges and compromise the entire application via HTTP. Exploitation requires network access and authentication credentials but no user interaction. Successful exploitation results in complete takeover of the Oracle Banking Origination system with high impact to confidentiality, integrity, and availability. Affected versions are 14.5.0.0.0 through 14.9.0.0.0; patch availability should be checked against Oracle's official security updates.
Affected products
- Oracle Banking Origination 14.5.0.0.0 to 14.9.0.0.0
Timeline
- 2026-09-15: disclosed