What is the CVSS score of CVE-2026-34320?

CVE-2026-34320 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Oracle Financial Services Customer Screening are affected by CVE-2026-34320?

Oracle Financial Services Customer Screening 8.1.2.8.0 contains an authorization flaw enabling unauthenticated remote attackers to access all application data through the User Interface component.

How to fix or mitigate CVE-2026-34320?

Within 24 hours, conduct a complete audit of deployed Customer Screening 8.1.2.8.0 instances to identify which financial and customer datasets are at risk, and quantify the business impact scope for leadership. Within 7 days, implement network segmentation by restricting access to affected systems through firewall rules, VPN-only enforcement, and IP whitelisting-since no vendor patch is currently available, these compensating controls are mandatory to prevent unauthorized access. Within 30 days, contact Oracle Support directly to obtain patch availability timeline and interim remediation guidance for version 8.1.2.8.0; prepare procurement and deployment plans for emergency patching or upgrade once the vendor releases a fix.

Oracle Financial Services Customer Screening CVE-2026-34320

EUVD-2026-24422 HIGH

Improper Authorization (CWE-285)

2026-04-21 oracle

GHSA-55h4-p6x2-6526

Authentication Bypass Oracle Oracle Financial Services Customer Screening Oracle Corporation

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Remote unauthenticated HTTP access with no user interaction (AV:N/AC:L/PR:N/UI:N) yielding full read of application data only, so C:H and I/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:09 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24422

CVE Published

Apr 21, 2026 - 20:35 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Financial Services Customer Screening product of Oracle Financial Services Applications (component: User Interface). The supported version that is affected is 8.1.2.8.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Customer Screening. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Financial Services Customer Screening accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Financial Services Customer Screening 8.1.2.8.0 (User Interface component) allows a remote, unauthenticated attacker with only HTTP network access to read all data accessible to the application. The flaw is an authorization/access-control weakness (CWE-285) that yields high confidentiality impact without any integrity or availability effect. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.03%, 9th percentile), indicating no observed exploitation activity.

Technical ContextAI

The affected product is Oracle Financial Services Customer Screening, a sanctions/watchlist and customer-screening module used in AML and financial-crime-compliance stacks; the affected CPE is cpe:2.3:a:oracle_corporation:oracle_financial_services_customer_screening. The root-cause class is CWE-285 (Improper Authorization), meaning the application fails to correctly enforce access-control checks on requests to the User Interface component, so a caller can reach data or functionality that authorization logic should have restricted. The vendor tag 'Authentication Bypass' reinforces that the control being circumvented is the front-end authentication/authorization boundary rather than a memory-safety or injection defect. Because the CVSS vector is C:H/I:N/A:N, the exposure is limited to reading data - the attacker gains visibility into application-accessible records but cannot modify data or disrupt service through this specific weakness.

RemediationAI

Apply the fixes from the Oracle April 2026 Critical Patch Update, which is the authoritative source for this CVE; consult https://www.oracle.com/security-alerts/cpuapr2026.html for the exact patch bundle and post-install steps applicable to Oracle Financial Services Customer Screening 8.1.2.8.0 (a specific standalone fix version was not provided in the input, so use the CPU-designated patch - Patch available per vendor advisory). Until the patch is deployed, reduce exposure by restricting network reachability of the Customer Screening User Interface to trusted internal networks or VPN only and placing it behind an authenticating reverse proxy or WAF that enforces access control on UI endpoints, accepting that this may inconvenience legitimate remote operators and requires tuning to avoid blocking valid screening workflows. Because the flaw is unauthenticated (PR:N), network-level access restriction is the most reliable compensating control until patching. Verify no direct internet exposure of the application front end and monitor access logs for anomalous UI requests.