What is the CVSS score of CVE-2026-34302?

CVE-2026-34302 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Oracle Workflow CVE-2026-34302

EUVD-2026-24393 MEDIUM

Improper Access Control (CWE-284)

2026-04-21 oracle

GHSA-gq3x-4cgf-f2fm

Authentication Bypass Denial Of Service Oracle Oracle Workflow Oracle Corporation

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L

vuln.today AI

5.5 MEDIUM

High privilege required to access Workflow Loader; scope change reflects EBS inter-module impact; no confidentiality loss confirmed by description.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:15 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24393

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 5.5

DescriptionCVE.org

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Loader). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Workflow. While the vulnerability is in Oracle Workflow, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Workflow accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Workflow. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L).

AnalysisAI

Oracle Workflow (E-Business Suite component, versions 12.2.3-12.2.15) exposes its Workflow Loader component to unauthorized data manipulation and partial denial of service by highly privileged network attackers over HTTP. The CVSS S:C (scope changed) designation confirms that a successful attack can cascade beyond Oracle Workflow itself to affect other products within the E-Business Suite application tier, amplifying the business impact beyond what the base score of 5.5 initially suggests. No public exploit has been identified and EPSS sits at 0.04% (11th percentile), indicating negligible exploitation probability at time of analysis; SSVC likewise assesses exploitation status as none.

Technical ContextAI

Oracle Workflow is a business process automation and document routing engine embedded in Oracle E-Business Suite (EBS). The affected component, Workflow Loader, is responsible for importing and managing workflow process definitions within the EBS application tier. CWE-284 (Improper Access Control) identifies the root cause class: the application fails to adequately enforce authorization boundaries, permitting an attacker operating with high privileges to perform data operations - insert, update, or delete - on Workflow-accessible data and to degrade service availability beyond their intended permission scope. The CPE string cpe:2.3:a:oracle_corporation:oracle_workflow:*:*:*:*:*:*:*:* covers the entire Oracle Workflow product line without sub-version granularity, though the vendor explicitly constrains affected versions to the 12.2.3-12.2.15 range of EBS. The scope change (S:C in CVSS) reflects that EBS is a tightly integrated suite where a compromise in one component - here, Workflow - can affect co-hosted EBS modules sharing the same application context and session state.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for April 2026, available via Oracle Support and documented at https://www.oracle.com/security-alerts/cpuapr2026.html; the specific patched version for Oracle Workflow within EBS 12.2 should be confirmed against the CPU patch matrix, as Oracle does not publish a standalone fixed version number in this advisory. Patch availability is confirmed per vendor advisory, but an independently verified fixed release version string was not available in the provided data. Where immediate patching is not feasible, compensating controls should focus on the Workflow Loader component specifically: restrict HTTP access to the Workflow Loader interface to only explicitly authorized administrative IP ranges at the network or application layer, enforce least-privilege principles to minimize the number of accounts holding high (PR:H) EBS Workflow privileges, and enable EBS audit logging for Workflow Loader operations to detect unauthorized insert/update/delete activity. Note that blocking Workflow Loader HTTP access may disrupt legitimate workflow definition imports and should be coordinated with EBS administrators.