CVE-2026-64618: SQL Injection in Fineract Search Engine

A SQL injection vulnerability has been discovered in Apache Fineract through version 1.15.0. The API endpoint /fineract-provider/api/v1/search/advance is vulnerable due to insufficient input neutralization in the outStandingAmountPercentageCondition parameter of CVE-2026-64618. This flaw allows an attacker to execute arbitrary SQL queries, exposing or modifying sensitive data in financial and microfinance systems that rely on Fineract.

The CVSS score is 9.8, classified as critical. The vulnerability was disclosed on October 30, 2026, and is already subject to discussion in the cybersecurity community. Apache released version 1.16.1 as the official fix. Social signals (not verified from a technical standpoint) indicate growing awareness of the threat, although active exploitation in the wild is not yet confirmed by official sources.

System administrators must immediately verify which Fineract versions are running in production. If version 1.15.0 or earlier is deployed, upgrading to 1.16.1 must be prioritized in coordination with development and release management teams. In parallel, monitor access to the search endpoint for suspicious queries and check database operation logs for unauthorized modifications, anomalous access patterns, and unusual read patterns from related parameters.