What is the CVSS score of CVE-2026-34312?

CVE-2026-34312 has a CVSS 3.1 base score of 2.4 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Oracle Database Server CVE-2026-34312

EUVD-2026-24408 LOW

Improper Access Control (CWE-284)

2026-04-21 oracle

GHSA-6fw3-qc3h-w7c9

Authentication Bypass Oracle Oracle Database Server

2.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.4 LOW

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

2.4 LOW

Row Access Method privilege is a confirmed high-privilege prerequisite (PR:H); human interaction required (UI:R); only partial confidentiality loss with no integrity or availability impact.

3.1 AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:12 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24408

CVE Published

Apr 21, 2026 - 20:35 nvd

LOW 2.4

DescriptionCVE.org

Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.30. Easily exploitable vulnerability allows high privileged attacker having Row Access Method privilege with network access via multiple protocols to compromise RDBMS. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of RDBMS accessible data. CVSS 3.1 Base Score 2.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthorized read access in Oracle Database Server's RDBMS component (versions 19.3-19.30) is achievable by a highly privileged attacker holding the Row Access Method privilege, via multiple network protocols, when a third party performs required human interaction. Impact is limited to a partial confidentiality disclosure of RDBMS-accessible data with no integrity or availability effects. No public exploit exists and EPSS at 0.03% (7th percentile) reflects near-zero exploitation likelihood; SSVC confirms exploitation status as none and the attack is not automatable.

Technical ContextAI

Oracle Database Server's RDBMS component exposes the Row Access Method (RAM) interface, a high-privilege mechanism governing low-level row retrieval operations. CWE-284 (Improper Access Control) identifies the root cause as insufficient enforcement of data access boundaries within this subsystem - an attacker who legitimately holds the RAM privilege can exploit this flaw through any Oracle-supported network protocol (SQL*Net, JDBC, OCI, etc.) to read rows outside their authorized data scope. The affected CPE cpe:2.3:a:oracle_corporation:oracle_database_server:*:*:*:*:*:*:*:* covers the entire 19c long-term support release train from 19.3 through 19.30. The 'Authentication Bypass' tag in the intelligence data is notable but conflicts with the PR:H CVSS metric - this likely refers to bypassing row-level security controls within the database engine, not bypassing database authentication itself.

RemediationAI

Apply Oracle's April 2026 Critical Patch Update (CPU), available at https://www.oracle.com/security-alerts/cpuapr2026.html, which addresses this flaw in Oracle Database Server 19.3-19.30. An exact patched Patch Set Update (PSU) or Release Update (RU) version number is not independently confirmed from available data - consult the Oracle CPU advisory directly to identify the specific patch. As a compensating control, revoke the Row Access Method privilege from any database accounts that do not operationally require it; this eliminates the required attacker prerequisite entirely. Additionally, restricting network-level access to the Oracle listener port to trusted hosts and monitoring privileged account data access patterns can reduce both attack surface and detection latency. Revoking the RAM privilege may affect applications relying on custom row access implementations - validate in a non-production environment before broad rollout.