CVE-2026-34298
Unauthorized Data Modification and Partial DoS in Oracle Applications Framework Personalization
Publication date: 2026-04-21
Last updated on: 2026-04-24
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | applications_framework | From 12.2.9 (inc) to 12.2.15 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthorized read, update, insert, or delete access to some data within Oracle Applications Framework, as well as the ability to cause a partial denial of service. Such unauthorized access and potential data manipulation could impact the confidentiality, integrity, and availability of data.
Because of these impacts, organizations using affected versions of Oracle Applications Framework might face challenges in maintaining compliance with data protection standards and regulations such as GDPR and HIPAA, which require strict controls over data confidentiality and integrity.
Can you explain this vulnerability to me?
This vulnerability exists in the Oracle Applications Framework component of the Oracle E-Business Suite, specifically affecting versions 12.2.9 through 12.2.15. It is easily exploitable by a high privileged attacker who has network access via HTTP. The attacker can compromise the Oracle Applications Framework by gaining unauthorized capabilities.
Successful exploitation can allow the attacker to perform unauthorized updates, inserts, or deletions of some accessible data within the Oracle Applications Framework. Additionally, the attacker can gain unauthorized read access to a subset of accessible data and cause a partial denial of service (partial DOS) affecting the availability of the framework.
How can this vulnerability impact me? :
The impact of this vulnerability includes unauthorized modification and access to data within the Oracle Applications Framework, which can compromise data integrity and confidentiality. Attackers with high privileges can update, insert, or delete data without authorization, and read sensitive data they should not have access to.
Furthermore, the vulnerability can lead to a partial denial of service, reducing the availability of the Oracle Applications Framework and potentially disrupting business operations that rely on it.