What is the CVSS score of CVE-2026-34310?

CVE-2026-34310 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Oracle OFSAA are affected by CVE-2026-34310?

Oracle Financial Services Analytical Applications Infrastructure (OFSAA) versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 contain an unauthenticated remote vulnerability allowing attackers to read critical…

How to fix or mitigate CVE-2026-34310?

Within 24 hours, inventory all systems running Oracle OFSAA and identify affected versions; classify the sensitivity of data within each instance and implement immediate network-level access restrictions to OFSAA services from authorized systems only. Within 7 days, contact Oracle support to confirm patch availability and obtain a security update timeline; deploy Web Application Firewall rules to monitor and block suspicious data access attempts; enable full request/response logging on OFSAA instances; and configure network monitoring to detect exploitation attempts. By day 30, either apply the vendor-released patch to all affected instances or operationalize compensating controls (HTTPS enforcement, IP allowlisting, MFA integration) as permanent mitigations, and begin planning migration to patched OFSAA versions or evaluate alternative financial analytics solutions to eliminate the vulnerability.

Oracle OFSAA CVE-2026-34310

EUVD-2026-24407 HIGH

Improper Access Control (CWE-284)

2026-04-21 oracle

GHSA-jwr7-8589-p67w

Authentication Bypass Oracle Oracle Financial Services Analytical Applications Infrastructure Oracle Corporation

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated remote HTTP access with no user interaction yields AV:N/AC:L/PR:N/UI:N; impact is confidentiality-only data disclosure (C:H, I:N, A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:12 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24407

CVE Published

Apr 21, 2026 - 20:35 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Financial Services Analytical Applications Infrastructure accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data access in Oracle Financial Services Analytical Applications Infrastructure (OFSAA) versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 lets a remote, unauthenticated attacker read critical data over HTTP with no user interaction. The flaw stems from improper access control (CWE-284) in the Platform component and is tagged as an authentication bypass, though impact is limited to confidentiality (no data modification or denial of service). No public exploit has been identified at time of analysis and EPSS exploitation probability is very low (0.03%).

Technical ContextAI

OFSAA is Oracle's enterprise analytics and regulatory-reporting framework used by banks and financial institutions for risk, compliance, and financial modeling. The vulnerability resides in the Platform component, the shared infrastructure layer that handles authentication, session management, and data access across OFSAA modules, exposed via HTTP. The root cause is CWE-284 (Improper Access Control): the application fails to correctly enforce authorization on a network-reachable interface, allowing an actor to reach protected data without valid credentials. The 'Authentication Bypass' tag reinforces that access-control enforcement - not memory safety or injection - is the failure class. The CPE (cpe:2.3:a:oracle_corporation:oracle_financial_services_analytical_applications_infrastructure) confirms the affected product but uses a wildcard version, so precise affected ranges come from Oracle's advisory and the EUVD version list rather than the CPE string.

RemediationAI

Apply the fixes delivered in Oracle's April 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuapr2026.html), which is the authoritative source for the exact patched build for each affected line (8.0.7.9, 8.0.8.7, 8.1.2.5); Patch available per vendor advisory, but a specific fixed version string is not enumerated in the provided data, so confirm the target build in the CPU matrix before deployment. Because Oracle CPU patches are cumulative, prioritize scheduling the OFSAA patch through your standard Oracle maintenance window. As compensating controls until patching, restrict network reachability of the OFSAA HTTP interface to trusted internal networks or VPN-only access (trade-off: may disrupt legitimate remote or integration access), place the application behind a WAF or reverse proxy that enforces authentication on Platform endpoints, and increase monitoring of HTTP access logs for anomalous unauthenticated data-retrieval requests. These controls reduce exposure of the unauthenticated attack surface but do not remediate the underlying access-control flaw.