[ CVE-2026-64618 · Published 30 Oct 2026 ]

Vulnerability in Apache Software Foundation Apache Fineract

CVSS 9.8 EPSS <1%Fix available

[ Why it matters ]Priority signals

Critical severity: CVSS 9.8

[ Description ]Official description

Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.

[ Fixes ]Fixes and patches

Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

github.com/apache/fineract/pull/6153Issue TrackingPatch
lists.apache.org/thread/s8orckszcd9x4d1qsloc046ppf5q9oc7Mailing ListVendor Advisory
www.openwall.com/lists/oss-security/2026/10/30/4Mailing ListThird Party Advisory