What is the CVSS score of CVE-2026-34291?

CVE-2026-34291 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Oracle HTTP Server are affected by CVE-2026-34291?

Oracle HTTP Server (versions 12.2.1.4.0 and 14.1.2.0.0) is vulnerable to unauthenticated remote attacks that allow attackers to read and modify critical data, with potential to compromise co-located…

How to fix or mitigate CVE-2026-34291?

Within 24 hours, inventory all systems running Oracle HTTP Server versions 12.2.1.4.0 or 14.1.2.0.0 and determine network exposure of affected servers. Within 7 days, implement network segmentation to restrict HTTP Server access to trusted administrative networks, deploy Web Application Firewall rules to block malformed HTTP requests, and establish daily monitoring of Oracle vendor advisories for patch releases. Within 30 days, maintain interim controls, test patch deployment in non-production environments, and prepare for immediate production deployment once a vendor patch is released; engage Oracle support for security guidance and patch timeline expectations.

Oracle HTTP Server CVE-2026-34291

EUVD-2026-24375 HIGH

Improper Access Control (CWE-284)

2026-04-21 oracle

GHSA-cc6c-v4r7-vf9x

Authentication Bypass Oracle Oracle Http Server Oracle Corporation

8.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Unauthenticated network HTTP reach (AV:N/PR:N/UI:N) but vendor-stated difficult trigger (AC:H); access-control bypass yields C:H/I:H with cross-boundary S:C and no availability loss (A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:19 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24375

CVE Published

Apr 21, 2026 - 20:35 nvd

HIGH 8.7

DescriptionCVE.org

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. While the vulnerability is in Oracle HTTP Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Cross-boundary compromise of Oracle HTTP Server (a component of Oracle Fusion Middleware) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated remote attacker sending crafted HTTP traffic can gain read and write access to critical server-accessible data and, via a scope change, impact additional co-located products. The CVSS 3.1 base score is 8.7 with high confidentiality and integrity impact but no availability impact, and the flaw is classified as improper access control (CWE-284) with an Authentication Bypass tag. Currently there is no public exploit identified at time of analysis, EPSS risk is low (0.03%, 9th percentile), and CISA's SSVC rates exploitation as none despite a 'total' technical impact rating.

Technical ContextAI

Oracle HTTP Server (OHS) is the web-tier front end of Oracle Fusion Middleware, built on Apache HTTP Server and used to proxy and serve requests for WebLogic and other back-end Oracle application components. The single affected CPE is cpe:2.3:a:oracle_corporation:oracle_http_server, and the root cause is CWE-284 (Improper Access Control), meaning the server fails to correctly enforce a restriction on who may perform an action or reach a resource. Because OHS sits in front of and shares trust with other Fusion Middleware products, the CVSS scope-change flag (S:C) indicates the access-control failure lets the impact cross the OHS security boundary into other components it fronts, which is consistent with the vendor note that attacks 'may significantly impact additional products' and the Authentication Bypass tag.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update Advisory of April 2026 (https://www.oracle.com/security-alerts/cpuapr2026.html); Oracle distributes OHS fixes exclusively through the quarterly CPU, so administrators should identify the corresponding CPU patch for their release (12.2.1.4.0 or 14.1.2.0.0) and apply it - the input does not provide a discrete fix build number, so treat this as 'Patch available per vendor advisory' and pull the exact patch ID from the April 2026 CPU. Until patched, reduce exposure of the OHS web tier: restrict network reachability of the HTTP/HTTPS listener to trusted networks or place it behind a reverse proxy or WAF that filters anomalous requests, and tighten OHS access-control (mod_authz/location) rules and virtual-host configuration to limit which resources and back-end mounts are reachable, accepting that overly aggressive filtering could break legitimate proxied application traffic and should be tested against your routing rules. Given the scope-change nature, also segment OHS from the back-end Fusion Middleware products it fronts so a boundary crossing has a smaller blast radius. These are compensating controls only - patching via the CPU is the definitive fix.