Vulnerabilities Patched in Oracle Financial Services Modules (advisories.ncsc.nl)

• Code injection via Apache Avro
• Authorization bypass in Spring Security
• DoS via resource exhaustion in Apache Netty and urllib3

"The Dutch National Cyber Security Centre (NCSC) issued advisory NCSC-2026-0258 detailing multiple vulnerabilities fixed in Oracle Financial Services and third-party components. Issues include code injection via Apache Avro, unauthorized data access, Spring Security authorization bypasses, JWT token validation flaws in Apache Kafka, insecure session management in Eclipse Jetty, and denial-of-service via resource exhaustion in Apache Netty and urllib3. Exploitation may lead to full system compromise or data leakage. Some vulnerabilities are remotely exploitable without authentication."