This vulnerability affects Oracle HTTP Server, a component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to compromise the server, potentially leading to unauthorized creation, deletion, or modification of critical data accessible through the server. The vulnerability impacts confidentiality and integrity with a CVSS 3.1 score of 8.7 and includes a scope change affecting additional Oracle products. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle has acknowledged the issue in its April 2026 Critical Patch Update advisory, which bundles patches for multiple vulnerabilities across various Oracle products, including Fusion Middleware. While the advisory strongly urges customers to apply the update promptly, it does not explicitly confirm a dedicated patch for this specific CVE. No known public exploits have been reported.

Successful exploitation of CVE-2026-34291 can result in unauthorized creation, deletion, or modification of critical data accessible via Oracle HTTP Server, as well as unauthorized access to such data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope of the vulnerability extends beyond Oracle HTTP Server to potentially affect additional Oracle products. The high CVSS score (8.7) reflects the significant risk posed by this vulnerability. No known exploits in the wild have been reported to date.

Oracle has included this vulnerability in its April 2026 Critical Patch Update advisory, which contains security patches for Fusion Middleware products including Oracle HTTP Server. Customers are strongly advised to apply the April 2026 Critical Patch Update promptly to address this and other vulnerabilities. Since no explicit patch or remediation level is confirmed for this specific CVE outside the advisory, organizations should monitor Oracle's advisory page for updates and ensure timely application of the recommended patches. No vendor advisory states that no action is required or that the issue is already mitigated; therefore, patching is the recommended mitigation.