CVE-2026-64618 — Vulnerability intelligence

apache — fineract

Published: 2026-10-30T08:29:02.904Z

CVSS

9.8

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.

Sources

• CVE-2026-64618
• Issue Tracking, Patch
• Mailing List, Vendor Advisory
• CVE-2026-64618