CVE-2026-34274: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Configurator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Configurator accessible data as well as unauthorized read access to a subset of Oracle Configurator accessible data. in Oracle Corporation Oracle Configurator
CVE-2026-34274 is a vulnerability in Oracle Configurator versions 12. 2. 3 through 12. 2. 15 that allows an unauthenticated attacker with network access via HTTP to compromise the product. Exploitation requires human interaction from a person other than the attacker and can lead to unauthorized read and write access to some Oracle Configurator accessible data. The vulnerability has a CVSS 3. 1 base score of 6. 1, indicating medium severity, with impacts on confidentiality and integrity but no impact on availability. The vulnerability also has scope change potential, meaning it may affect additional products beyond Oracle Configurator.
AI Analysis
Technical Summary
CVE-2026-34274 is a medium severity vulnerability in the User Interface component of Oracle Configurator within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, delete, and read operations on accessible data, contingent on human interaction from a third party. The vulnerability affects confidentiality and integrity with a CVSS vector indicating network attack vector, low attack complexity, no privileges required, required user interaction, scope change, and no impact on availability. The vulnerability may also impact other Oracle products due to scope change. Oracle’s April 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this CVE. Customers are urged to apply the latest Critical Patch Update promptly to mitigate risks.
Potential Impact
Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible via Oracle Configurator, potentially affecting confidentiality and integrity of data. The vulnerability requires human interaction from a user other than the attacker and network access via HTTP. There is no reported impact on system availability. The scope of impact may extend beyond Oracle Configurator to other Oracle products due to the scope change. No known exploits are currently reported in the wild.
Mitigation Recommendations
Oracle’s advisory for the April 2026 Critical Patch Update recommends applying the update promptly to address multiple vulnerabilities including those affecting Oracle Configurator. Although the advisory does not explicitly confirm a patch for CVE-2026-34274, it strongly advises customers to remain on actively supported versions and apply Critical Patch Updates without delay. Organizations should verify patch availability in the official Oracle patch documentation linked in the advisory and apply relevant patches accordingly. Until patches are confirmed and applied, limiting network exposure of Oracle Configurator interfaces and educating users to avoid interacting with suspicious content may reduce risk.
CVE-2026-34274: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Configurator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Configurator accessible data as well as unauthorized read access to a subset of Oracle Configurator accessible data. in Oracle Corporation Oracle Configurator
Description
CVE-2026-34274 is a vulnerability in Oracle Configurator versions 12. 2. 3 through 12. 2. 15 that allows an unauthenticated attacker with network access via HTTP to compromise the product. Exploitation requires human interaction from a person other than the attacker and can lead to unauthorized read and write access to some Oracle Configurator accessible data. The vulnerability has a CVSS 3. 1 base score of 6. 1, indicating medium severity, with impacts on confidentiality and integrity but no impact on availability. The vulnerability also has scope change potential, meaning it may affect additional products beyond Oracle Configurator.
CVSS v3.1
Score 6.1medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-34274 is a medium severity vulnerability in the User Interface component of Oracle Configurator within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, delete, and read operations on accessible data, contingent on human interaction from a third party. The vulnerability affects confidentiality and integrity with a CVSS vector indicating network attack vector, low attack complexity, no privileges required, required user interaction, scope change, and no impact on availability. The vulnerability may also impact other Oracle products due to scope change. Oracle’s April 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this CVE. Customers are urged to apply the latest Critical Patch Update promptly to mitigate risks.
Potential Impact
Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible via Oracle Configurator, potentially affecting confidentiality and integrity of data. The vulnerability requires human interaction from a user other than the attacker and network access via HTTP. There is no reported impact on system availability. The scope of impact may extend beyond Oracle Configurator to other Oracle products due to the scope change. No known exploits are currently reported in the wild.
Mitigation Recommendations
Oracle’s advisory for the April 2026 Critical Patch Update recommends applying the update promptly to address multiple vulnerabilities including those affecting Oracle Configurator. Although the advisory does not explicitly confirm a patch for CVE-2026-34274, it strongly advises customers to remain on actively supported versions and apply Critical Patch Updates without delay. Organizations should verify patch availability in the official Oracle patch documentation linked in the advisory and apply relevant patches accordingly. Until patches are confirmed and applied, limiting network exposure of Oracle Configurator interfaces and educating users to avoid interacting with suspicious content may reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-03-26T19:48:45.675Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cpuapr2026.html","vendor":"Oracle"}]
Threat ID: 69e7e5a219fe3cd2cdf9f7b4
Added to database: 4/21/2026, 9:01:22 PM
Last enriched: 4/29/2026, 11:34:55 AM
Last updated: 6/3/2026, 9:14:41 PM
Views: 40
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.