Unscored severity · published Oct 30, 2026
CVE-2026-64618
Apache Fineract: SQL injection vulnerability in Search API
New
–
CVSS
–
EPSS
No
On KEV
Description
Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Apache Fineract · Apache Software Foundation
through 1.15.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-64618
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-64618
patch
https://github.com/apache/fineract/pull/6153
vendor-advisory
https://lists.apache.org/thread/s8orckszcd9x4d1qsloc046ppf5q9oc7
More from Apache Fineract
9.8
CVE-2024-23538
Apache Fineract: Under certain system configurations, the sqlSearch parameter was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries.
9.8
CVE-2024-23539
Apache Fineract: Under certain system configurations, the sqlSearch parameter for specific endpoints was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries.
9.1
CVE-2025-58130
Apache Fineract: Server Key not masked
8.8
CVE-2026-35152
Apache Fineract: SQL injection in runreports endpoint
8.8
CVE-2024-32838
Apache Fineract: SQL injection vulnerabilities in offices API endpoint