This vulnerability in Oracle Financial Services Customer Screening (version 8.1.2.8.0) allows an unauthenticated remote attacker to access sensitive data via HTTP without requiring privileges or user interaction. The flaw resides in the User Interface component and results in a high confidentiality impact (CVSS 3.1 score 7.5). The vulnerability is categorized under CWE-285 (Improper Authorization). Oracle’s April 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm patch availability for this product or CVE. The product is not a cloud service, so remediation depends on customer-applied patches.

Successful exploitation of this vulnerability can lead to unauthorized access to critical or all data accessible through Oracle Financial Services Customer Screening 8.1.2.8.0. The attacker does not need authentication, privileges, or user interaction, making the confidentiality impact high. There is no reported impact on integrity or availability. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed for CVE-2026-34320 in the provided Oracle advisory. Customers should monitor Oracle’s official Critical Patch Update advisories and apply relevant patches promptly once available. Oracle strongly recommends applying Critical Patch Updates without delay to mitigate vulnerabilities. Until a specific patch is confirmed, restrict network access to the affected product where possible and follow Oracle’s security best practices for this product. Check the vendor advisory at https://www.oracle.com/security-alerts/cpuapr2026.html for the latest remediation guidance.