by Kastro
Paper/Archive/CVE-2026-64618

CVE-2026-64618

Apache Software Foundation Apache Fineract — Apache Fineract: SQL injection vulnerability in Search API

EPSS 0.2%CVSS 9.8
critical.is priorityof 100
32
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 13.7.137 × 202.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.

Affected

ProductAffectedFixed inSource
Apache Fineract≤ 1.15.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

patchgithub.com/apache/fineract/pull/6153advisorylists.apache.org/thread/s8orckszcd9x4d1qsloc046ppf5q9oc7refopenwall.com/lists/oss-security/2026/10/30/4