CVE-2026-64618: SQL injection in the advanced search API of Apache Fineract

What happened and what to do

The advisory, published on 29 October 2026 on the oss-sec list and rated important, covers a SQL injection vulnerability in Apache Fineract up to version 1.15.0. The flaw is in the outStandingAmountPercentageCondition parameter of the endpoint /fineract-provider/api/v1/search/advance. According to the text, insufficient input validation allows SQL commands to be injected through this parameter.

A company running Fineract should start with an inventory of its instances, their versions and the search endpoints reachable from internal networks or the internet. In parallel, the attack surface can be reduced with gateway or WAF rules that restrict the affected parameter, limiting access to the endpoint to the networks and roles that need it, and reviewing the database account used by the application under least privilege. Logs should be monitored for unusual values in that parameter. In the medium term, plan an upgrade to a fixed release once the project publishes one, testing the change in staging before production.

How the consultancy can help

Diagnosis of Fineract exposure in your environment: deployed versions, reachable search endpoints and database account permissions. We then implement temporary containment, input validation, request monitoring and an upgrade plan operated on your infrastructure.

Next step

Send a short description of your Fineract setup (version, environment, where the search API is accessed and by whom). With it, we prepare a scoped proposal for diagnosis and remediation for your case.