CVE-2026-34291
Published: 21 April 2026
Summary
CVE-2026-34291 is a high-severity Improper Access Control (CWE-284) vulnerability in Oracle Http Server. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely application of Oracle's patch to remediate the improper access control flaw in the HTTP Server Core component, directly preventing exploitation of CVE-2026-34291.
Enforces approved authorizations for logical access, countering the vulnerability's unauthorized creation, deletion, modification, and access to critical data.
Monitors and controls communications at the network boundary via HTTP, mitigating unauthenticated remote exploits with potential scope change to additional products.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an improper access control flaw in a public-facing Oracle HTTP Server component, directly enabling unauthenticated remote exploitation over HTTP to compromise the server and access/modify data, which maps to T1190 Exploit Public-Facing Application.
NVD Description
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. While…
more
the vulnerability is in Oracle HTTP Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
Deeper analysisAI
CVE-2026-34291 is a vulnerability in the Core component of Oracle HTTP Server, which is part of Oracle Fusion Middleware. The supported versions affected are 12.2.1.4.0 and 14.1.2.0.0. It is classified under CWE-284 (Improper Access Control) and carries a CVSS 3.1 Base Score of 8.7, with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N, indicating high confidentiality and integrity impacts but no availability impact.
An unauthenticated attacker with network access via HTTP can exploit this difficult-to-exploit vulnerability (high attack complexity) to compromise Oracle HTTP Server. Although the flaw resides in Oracle HTTP Server, successful exploitation results in a scope change that may significantly impact additional products. Attackers can achieve unauthorized creation, deletion, or modification of critical data or all Oracle HTTP Server accessible data, as well as unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data.
Oracle's Critical Patch Update for April 2026 provides details on mitigation, including available patches, as documented in the security advisory at https://www.oracle.com/security-alerts/cpuapr2026.html.
Details
- CWE(s)