CVE-2026-64618
Apache Fineract: SQL injection
- Risk score
- 66/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 30 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A SQL injection vulnerability exists in Apache Fineract due to insufficient input neutralization, allowing attackers to inject malicious SQL commands. This could lead to high impact, including the ability to read, modify, or delete sensitive data, and potentially take control of the system.
- Affected
- {'products': ['Apache Fineract'], 'packages': [], 'versions': ['through 1.15.0']}
- Fix
- Upgrade to version 1.16.1
- Exploitation
- No known exploitation
Story map
At a glance
Apache Fineract: Amber, patch this week. A SQL injection vulnerability exists in Apache Fineract due to insufficient input neutralization, allowing attackers to inject malicious SQL commands. This could lead to high impact, including the ability to read, modify, or delete sensitive data, and potentially take control of the system.
The flaws
- CVE-2026-64618: SQL injection (CVSS 9.8 · EPSS 0%)
- CVE-2026-65874: SQL injection (CVSS 8.8 · EPSS 0%)
The fix
Upgrade Apache Fineract: 1.16.1 or later on your release line
Who is exposed: {'products': ['Apache Fineract'], 'packages': [], 'versions': ['through 1.15.0']}
Where it stands
- No known exploitation
Connects to
- Same weakness: SQL injection (CWE-89). 399 other warnings in 30 days
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.
Last activity 30 Oct 2026. Patch Forecast updates every hour.