What is the CVSS score of CVE-2026-34314?

CVE-2026-34314 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Oracle OFSAAI CVE-2026-34314

EUVD-2026-24412 MEDIUM

Improper Access Control (CWE-284)

2026-04-21 oracle

Authentication Bypass Oracle Oracle Financial Services Analytical Applications Infrastructure Oracle Corporation

6.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.8 MEDIUM

Network-reachable via HTTP with low-privilege auth required; high complexity reflects non-trivial exploitation precondition; no availability impact stated.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:11 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24412

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 6.8

DescriptionCVE.org

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Analytical Applications Infrastructure accessible data as well as unauthorized access to critical data or complete access to all Oracle Financial Services Analytical Applications Infrastructure accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Improper access control in Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) Platform component allows a low-privileged remote attacker to bypass authorization controls and gain unauthorized read and write access to all financial data managed by the platform. Versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 are confirmed affected. No public exploit code has been identified at time of analysis, and EPSS at 0.03% (9th percentile) signals very low observed exploitation probability, though the SSVC technical impact is rated 'total' given the full confidentiality and integrity exposure.

Technical ContextAI

Oracle Financial Services Analytical Applications Infrastructure is an enterprise analytics platform used by financial institutions for risk, compliance, and financial crime analytics workloads. The vulnerability resides in the Platform component and is reachable over HTTP. CWE-284 (Improper Access Control) identifies the root cause class: the system fails to correctly enforce authorization boundaries, allowing a legitimately authenticated but low-privileged user to exceed their intended access scope. The 'Authentication Bypass' tag in the intelligence data suggests the bypass mechanism escalates an existing low-privilege session rather than enabling fully unauthenticated access, consistent with the CVSS PR:L metric. The AC:H metric indicates the exploit is not trivially repeatable and likely requires specific timing, session state, or race-condition-class conditions. Affected CPE: cpe:2.3:a:oracle_corporation:oracle_financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*.

RemediationAI

Apply Oracle's Critical Patch Update (CPU) for April 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpuapr2026.html. No specific patched release version is identified in the available data beyond the CPU reference itself - consult the Oracle CPU directly to confirm the exact update package for your version (8.0.7.9, 8.0.8.7, or 8.1.2.5). As a compensating control pending patch application, restrict network-level access to OFSAAI Platform HTTP endpoints to only authorized low-privilege users and reduce the OFSAAI user population to the minimum required - this does not eliminate the vulnerability but raises the bar by reducing the attacker pool. Network segmentation to prevent general corporate network access to OFSAAI reduces exposure but carries the trade-off of limiting legitimate user access. No workaround is confirmed by vendor advisory.