CVE-2026-64618: apache fineract

CVSS 9.8 (critical) · published 2026-10-30

Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.

Affected products (NVD): apache fineract

Fixed in (NVD): 1.16.0

Weakness: CWE-89

Source: NVD CVE-2026-64618

References

• https://github.com/apache/fineract/pull/6153
• https://lists.apache.org/thread/s8orckszcd9x4d1qsloc046ppf5q9oc7
• http://www.openwall.com/lists/oss-security/2026/10/30/4

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.