← CVE Radar
CVE-2026-64618Apache Fineract: SQL injection vulnerability in Search API
Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.
9.8 CRITICALEPSS 0.62%Not in KEVNVD: Modified
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Details
- CVE ID
- CVE-2026-64618
- Status
- Modified
- Assigner (CNA)
- apache
- Published
- Oct 30, 2026
- Last modified
- 2026-11-06 17:19 UTC
- Weaknesses
- CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
As published by the CNA in the CVE record.
Apache Software FoundationApache Fineract1 version range
- through 1.15.0