CVE-2026-34297
Published: 21 April 2026
Summary
CVE-2026-34297 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Oracle Hcm Common Architecture. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SC-14 (Public Access Protections).
Deeper analysis
CVE-2026-34297 is a vulnerability in the Knowledge Integration component of the Oracle HCM Common Architecture product within Oracle E-Business Suite. The supported versions affected by this issue range from 12.2.3 to 12.2.15.
The vulnerability is easily exploitable by an unauthenticated attacker who has network access via HTTP. Successful exploitation allows the attacker to compromise Oracle HCM Common Architecture, resulting in unauthorized access to critical data or complete access to all Oracle HCM Common Architecture accessible data. It carries a CVSS 3.1 base score of 7.5, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating high confidentiality impact and mapping to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).
Oracle's Critical Patch Update for April 2026 addresses this vulnerability, with details available at https://www.oracle.com/security-alerts/cpuapr2026.html. Affected systems should be patched according to the advisory to mitigate exploitation risks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24384
Vulnerability details
Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Knowledge Integration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HCM Common Architecture. Successful…
more
attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HCM Common Architecture accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated remote information disclosure flaw in a public-facing Oracle E-Business Suite web component, directly enabling T1190: Exploit Public-Facing Application for unauthorized data access over HTTP.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the vulnerability by requiring timely identification, reporting, and patching of known flaws like CVE-2026-34297 as addressed in Oracle's Critical Patch Update.
Enforces monitoring and control of communications at system boundaries to block unauthenticated network access via HTTP required to exploit the vulnerability.
Establishes specific protections for publicly accessible HTTP services and communications, reducing the risk of unauthenticated exploitation leading to data exposure.