CVE-2026-34302 is a vulnerability in the Oracle Workflow product of Oracle E-Business Suite, specifically in the Workflow Loader component, affecting versions 12.2.3 through 12.2.15. It allows a high privileged attacker with network access via HTTP to compromise Oracle Workflow by unauthorized modification (update, insert, delete) of accessible data and to cause a partial denial of service. The vulnerability has a CVSS 3.1 score of 5.5 with network attack vector, low attack complexity, high privileges required, no user interaction, and scope change affecting integrity and availability. The vulnerability may also impact other Oracle products due to scope change. Oracle has referenced this vulnerability in its April 2026 Critical Patch Update advisory, which contains numerous patches for multiple products. The advisory strongly recommends applying the update but does not explicitly confirm a dedicated patch for this specific vulnerability.

Successful exploitation allows a high privileged attacker with network access to perform unauthorized data modifications (update, insert, delete) within Oracle Workflow and cause a partial denial of service affecting availability. There is no confidentiality impact reported. The vulnerability may also affect additional Oracle products due to scope change. No known exploits in the wild have been reported as of the advisory date.

Oracle has included this vulnerability in its April 2026 Critical Patch Update advisory. Customers are strongly advised to apply the April 2026 Critical Patch Update promptly to address this and other vulnerabilities. Patch status for this specific vulnerability is not explicitly confirmed in the advisory; therefore, customers should consult the April 2026 Critical Patch Update documentation and apply all relevant patches for Oracle Workflow versions 12.2.3 to 12.2.15. Maintaining up-to-date patching is critical to mitigate this vulnerability.