What is the CVSS score of CVE-2026-34297?

CVE-2026-34297 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-34297?

Oracle HCM Common Architecture in E-Business Suite versions 12.2.3-12.2.15 contains an unauthenticated remote information disclosure vulnerability exposing critical employee and payroll data.

How to fix or mitigate CVE-2026-34297?

Immediately identify and isolate all E-Business Suite instances running versions 12.2.3-12.2.15; restrict HCM system access to internal networks only and audit Knowledge Integration access logs for suspicious remote activity. Over the following week, deploy Web Application Firewall rules to block exploitation attempts against Knowledge Integration endpoints, enable comprehensive audit logging for all HCM data access, and verify no unauthorized data access has occurred. Within 30 days, apply vendor patch through the Critical Patch Update process or plan emergency upgrade to a supported version if patch availability is delayed.

Oracle E-Business Suite CVE-2026-34297

EUVD-2026-24384 HIGH

Information Exposure (CWE-200)

2026-04-21 oracle

GHSA-jfmq-5jhp-qf3w

Authentication Bypass Information Disclosure Oracle Oracle Hcm Common Architecture Oracle Corporation

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Description confirms unauthenticated network HTTP access (AV:N/PR:N/UI:N/AC:L) with confidentiality-only data exposure, so C:H and I:N/A:N, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:17 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24384

CVE Published

Apr 21, 2026 - 20:35 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Knowledge Integration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HCM Common Architecture. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HCM Common Architecture accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized information disclosure in Oracle HCM Common Architecture (Knowledge Integration component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a remote, unauthenticated attacker read critical HCM data over HTTP without any user interaction. Oracle rates this 7.5 (confidentiality-only impact) and addressed it in the April 2026 Critical Patch Update. There is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.03%), but SSVC flags the attack as automatable.

Technical ContextAI

The flaw sits in the Knowledge Integration component of Oracle HCM Common Architecture, a shared services layer within the Oracle E-Business Suite ERP platform (CPE cpe:2.3:a:oracle_corporation:oracle_hcm_common_architecture). It is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), meaning an HTTP-accessible endpoint returns or exposes data it should protect, without enforcing proper access control. Because the CVSS scope is Unchanged (S:U) and only confidentiality is affected (C:H, I:N, A:N), the weakness reads more like a broken/absent authorization check on a data-serving interface than a memory-corruption or code-execution bug; data can be extracted but not modified and service availability is unaffected.

RemediationAI

Apply the fixes from the Oracle April 2026 Critical Patch Update; patch is available per vendor advisory at https://www.oracle.com/security-alerts/cpuapr2026.html, though Oracle does not publish a single discrete fixed build number for this component (fixes are delivered as CPU patch sets against the 12.2.x line). Because exploitation is unauthenticated and over HTTP, if you cannot patch immediately, restrict network reachability of the affected EBS/HCM endpoints - place them behind a VPN or IP allowlist, block untrusted access to the Knowledge Integration interface at the reverse proxy/WAF, and monitor HTTP logs for anomalous data-retrieval requests; the trade-off is that URL/IP filtering may disrupt legitimate integrations that call these endpoints and a WAF rule risks false positives, so validate against known integration traffic before enforcing. Given the internet-facing, automatable nature, prioritize removing direct external exposure of Oracle E-Business Suite as the key compensating control until the CPU is applied.