What is the CVSS score of CVE-2026-34321?

CVE-2026-34321 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Oracle OFSAAI CVE-2026-34321

EUVD-2026-24424 MEDIUM

Improper Authorization (CWE-285)

2026-04-21 oracle

GHSA-jg6h-qcfc-fqx4

Authentication Bypass Oracle Oracle Financial Services Analytical Applications Infrastructure Oracle Corporation

4.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

4.8 MEDIUM

Network HTTP access required, but AC:H reflects difficult exploit conditions; PR:L confirmed by description; UI:R limits automation; confidentiality only impact with no integrity or availability effect.

3.1 AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:09 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24424

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 4.8

DescriptionCVE.org

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: User Interface). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Financial Services Analytical Applications Infrastructure accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N).

AnalysisAI

Improper authorization in the User Interface component of Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) exposes critical financial data to low-privileged network attackers. Affected versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 allow an authenticated attacker to bypass authorization controls via HTTP, contingent on human interaction from a victim user, resulting in complete confidentiality compromise of all data accessible within the platform. No public exploit exists and EPSS sits at 0.03%, indicating negligible opportunistic exploitation pressure at time of analysis.

Technical ContextAI

OFSAAI is Oracle's enterprise analytical platform for financial institutions, providing risk, compliance, and performance management capabilities through a web-based User Interface. CWE-285 (Improper Authorization) identifies the root cause: the application fails to correctly enforce authorization decisions, allowing a lower-privileged principal to access resources or data reserved for higher-privilege roles. The HTTP vector confirms this is a web-tier flaw in the UI layer rather than a database or middleware component. The 'Authentication Bypass' tag, paired with CWE-285, suggests the authorization check - not authentication itself - is defective: a legitimately authenticated low-privileged user can circumvent access controls to reach data they should not be permitted to read. CPE string cpe:2.3:a:oracle_corporation:oracle_financial_services_analytical_applications_infrastructure confirms Oracle Corporation as the vendor with the three discrete patch levels as affected targets.

RemediationAI

Apply Oracle's Critical Patch Update released April 2026, available via the Oracle Security Alerts portal at https://www.oracle.com/security-alerts/cpuapr2026.html. Oracle does not publish discrete patched version numbers in its CPU advisories; customers should apply the cumulative patch bundle for their respective release line (8.0.7.9, 8.0.8.7, or 8.1.2.5) as directed by the advisory. As a compensating control pending patching, restrict OFSAAI UI access to the minimum required set of internal network segments and enforce role-based account hygiene to limit the pool of low-privileged accounts that could be leveraged; this directly reduces the attacker population. Additionally, configure web application firewall rules to log and alert on anomalous data-access patterns in the UI tier. Note that these controls reduce exposure but do not remediate the underlying authorization defect.