What is the CVSS score of CVE-2026-34325?

CVE-2026-34325 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H. EPSS exploitation probability: 0.0%.

Oracle OFSAAI CVE-2026-34325

EUVD-2026-24430 MEDIUM

Improper Access Control (CWE-284)

2026-04-21 oracle

GHSA-f84h-9pvq-86q2

Authentication Bypass Oracle Oracle Financial Services Analytical Applications Infrastructure Oracle Corporation

6.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H

vuln.today AI

6.8 MEDIUM

Local access and low privileges required per description; UI:R reflects mandatory second-user interaction; C:H and A:H match complete data exposure and full crash capability; I:L reflects partial write access only.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:07 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24430

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 6.8

DescriptionCVE.org

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: User Interface). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Financial Services Analytical Applications Infrastructure executes to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Financial Services Analytical Applications Infrastructure accessible data as well as unauthorized update, insert or delete access to some of Oracle Financial Services Analytical Applications Infrastructure accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Financial Services Analytical Applications Infrastructure. CVSS 3.1 Base Score 6.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H).

AnalysisAI

Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 contain an improper access control flaw (CWE-284) in the User Interface component that permits a locally authenticated low-privileged attacker - contingent on inducing a second user to interact - to bypass access controls and obtain complete read access to all OFSAAI-accessible financial data, perform limited data modification, and trigger a full denial-of-service by crashing or hanging the platform. Disclosed in Oracle's April 2026 Critical Patch Update, this vulnerability carries no public exploit code and no active exploitation per CISA KEV, SSVC, or EPSS (0.01%, 2nd percentile), situating it as a medium-priority insider threat relevant to financial institutions running these specific versions.

Technical ContextAI

OFSAAI is Oracle's enterprise financial analytics platform, used by banks and financial institutions to manage analytical data models, regulatory reporting, and financial consolidation workflows. The affected component is the User Interface layer (CPE: cpe:2.3:a:oracle_corporation:oracle_financial_services_analytical_applications_infrastructure for versions 8.0.7.9, 8.0.8.7, and 8.1.2.5). The root cause class is CWE-284 (Improper Access Control), consistent with the 'Authentication Bypass' tag - indicating that the UI fails to properly validate or enforce the access permissions of the interacting session, allowing a low-privileged user to escalate effective access beyond their intended authorization level. Because OFSAAI's UI mediates access to sensitive financial data models, reporting dashboards, and analytical datasets, a breakdown at this layer can expose the entire data footprint the application can reach. The local attack vector (AV:L) confirms exploitation requires an existing logon session on the OFSAAI host, not a remote network path.

RemediationAI

Apply Oracle's April 2026 Critical Patch Update, which addresses CVE-2026-34325 across affected OFSAAI versions 8.0.7.9, 8.0.8.7, and 8.1.2.5; the advisory and patch matrix are published at https://www.oracle.com/security-alerts/cpuapr2026.html. Exact patched build designations should be confirmed against the Oracle CPU patch availability matrix for the respective base versions, as Oracle CPU advisories do not always surface a single patched version number in public-facing documents. As interim compensating controls pending patch deployment, restrict local logon access to the OFSAAI infrastructure host to the minimum required operational personnel, reducing the pool of potential low-privileged attackers; this directly targets the AV:L/PR:L prerequisites. Additionally, deploy user awareness guidance advising OFSAAI users to be cautious of unexpected prompts or interface interactions, reducing the likelihood of the UI:R human interaction condition being met via social engineering. Monitoring OFSAAI UI session activity for anomalous data access patterns can provide detection coverage. No non-patch workaround has been identified that eliminates the underlying CWE-284 access control flaw.