What is the CVSS score of CVE-2026-34313?

CVE-2026-34313 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Oracle OFSAAI CVE-2026-34313

EUVD-2026-24410 MEDIUM

Information Exposure (CWE-200)

2026-04-21 oracle

Authentication Bypass Information Disclosure Oracle Oracle Financial Services Analytical Applications Infrastructure Oracle Corporation

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible via HTTP with low privilege required; confidentiality only - no integrity or availability impact applies per description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:11 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24410

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 6.5

DescriptionCVE.org

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Financial Services Analytical Applications Infrastructure accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data exposure in Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 allows a low-privileged, network-authenticated attacker to read critical or complete data accessible within the platform via HTTP. The Platform component contains a CWE-200 information disclosure flaw that, per Oracle's April 2026 CPU, is classified as 'easily exploitable' under authenticated low-privilege conditions. No public exploit code has been identified and CISA has not listed this in KEV; EPSS at 0.03% (9th percentile) and SSVC exploitation status of 'none' indicate no observed active exploitation at time of analysis.

Technical ContextAI

Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) is a data and analytics platform built for financial services institutions, providing risk, regulatory, and performance management capabilities. The affected component is the core 'Platform' layer, which handles data access and session management across the application. The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating that the application fails to properly enforce access controls or data visibility boundaries for authenticated low-privilege users. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_financial_services_analytical_applications_infrastructure. Notably, the vulnerability is tagged 'Authentication Bypass' despite the CVSS vector specifying PR:L - this suggests partial authorization bypass rather than complete authentication circumvention: a low-privilege account can bypass downstream access controls to retrieve data beyond its permitted scope.

RemediationAI

Apply the Oracle Critical Patch Update for April 2026, available at https://www.oracle.com/security-alerts/cpuapr2026.html, which addresses this vulnerability across all three affected OFSAAI versions (8.0.7.9, 8.0.8.7, 8.1.2.5). Exact patched build numbers should be confirmed via the Oracle CPU patch matrix. As a compensating control prior to patching, restrict HTTP access to the OFSAAI Platform component to only trusted internal networks and authorized user segments using network perimeter controls, reducing the pool of users who can supply the required low-privilege credentials. Additionally, audit existing OFSAAI user accounts for principle-of-least-privilege compliance, removing any unnecessary low-privilege accounts that could be exploited. Note that network restriction alone does not eliminate the flaw if insider threat or compromised accounts are the concern; patching remains the definitive remediation.