This vulnerability affects the RDBMS component of Oracle Database Server versions 19.3 through 19.30. An attacker with high privileges and Row Access Method privilege, who can access the database over the network via multiple protocols, may exploit this vulnerability to read unauthorized data subsets. Successful exploitation requires user interaction from a third party. The CVSS 3.1 base score is 2.4, reflecting a low-severity confidentiality impact with no impact on integrity or availability. Oracle's April 2026 Critical Patch Update advisory references this and many other vulnerabilities but does not provide explicit patch details for this CVE. No known exploits in the wild have been reported.

The vulnerability allows unauthorized read access to some data within the Oracle Database Server for attackers with specific high privileges and network access. The impact is limited to confidentiality with no reported effects on data integrity or system availability. Exploitation requires human interaction, which reduces the likelihood of automated or widespread attacks. There are no known active exploits targeting this vulnerability at this time.

Oracle's April 2026 Critical Patch Update advisory includes this vulnerability among many others but does not explicitly confirm patch availability or remediation for CVE-2026-34312. Customers are strongly advised to remain on actively supported Oracle Database versions and apply the latest Critical Patch Updates promptly. Since no specific patch or workaround is detailed, organizations should monitor Oracle's security advisories for updates. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.