Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.
Critical 9.8Patch available
CVE-2026-64618
Apache Fineract — SQL injection.
Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0).
WeaknessCWE-89: SQL injection
Published Updated Source NVD
CVSS 3.1
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploit chance, 30 days
0.2%
Higher than 13% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Available
See the vendor advisory
What happened
What to do
- 01Check whether you run Apache Fineract, and which version.
- 02Install the fixed version listed in the vendor advisory.
References
Timeline · UTC
- Published to NVD
- NVD record updated
Also actively exploited
Other CVEs from Apache
40+ more CVEs
9.8Apache MINA — unsafe deserialization.EPSS 0.6%10.0Apache Traffic Server — incorrect authorization.EPSS 0.4%10.0Apache Traffic Server — improper certificate validation.EPSS 0.2%10.0Apache Traffic Server — improper certificate validation.EPSS 0.2%9.0Apache Traffic Server — missing authentication.EPSS 0.4%9.3Apache Apache Traffic Server — Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or…EPSS 0.2%