CVE-2026-34291
Unauthorized Access Vulnerability in Oracle HTTP Server
Publication date: 2026-04-21
Last updated on: 2026-04-23
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | http_server | 12.2.1.4.0 |
| oracle | http_server | 14.1.2.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an unauthenticated attacker with network access to compromise Oracle HTTP Server, potentially resulting in unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to all Oracle HTTP Server accessible data.
Such unauthorized access and modification of critical data could lead to violations of data protection standards and regulations like GDPR and HIPAA, which require strict controls over the confidentiality and integrity of sensitive data.
Therefore, exploitation of this vulnerability may negatively impact compliance with these regulations by exposing sensitive data or allowing unauthorized data manipulation.
Can you explain this vulnerability to me?
This vulnerability exists in the Oracle HTTP Server component of Oracle Fusion Middleware, specifically affecting versions 12.2.1.4.0 and 14.1.2.0.0.
It is a difficult to exploit vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise the Oracle HTTP Server.
Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or any data accessible through the Oracle HTTP Server.
The vulnerability has a high severity with a CVSS 3.1 base score of 8.7, indicating significant impacts on confidentiality and integrity.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow attackers to gain unauthorized access to critical data or all data accessible via the Oracle HTTP Server.
Attackers may be able to create, delete, or modify critical data without authorization.
Because the scope of the attack may extend beyond the Oracle HTTP Server itself, additional products integrated with it could also be significantly impacted.