This vulnerability affects the User Interface component of Oracle Financial Services Analytical Applications Infrastructure in specified versions. It permits a low privileged attacker with network access over HTTP to compromise the system, contingent on human interaction from a third party. Successful exploitation can lead to unauthorized access to critical or all accessible data within the affected infrastructure. The CVSS vector indicates network attack vector, high attack complexity, low privileges required, user interaction required, unchanged scope, high confidentiality impact, and no impact on integrity or availability. The vulnerability is considered difficult to exploit and has a medium severity rating. Oracle's April 2026 Critical Patch Update advisory references multiple patches but does not explicitly state patch availability or remediation status for this specific vulnerability. Customers are advised to review the advisory and apply relevant patches promptly.

Successful exploitation can result in unauthorized access to critical or all accessible data within Oracle Financial Services Analytical Applications Infrastructure. There is no reported impact on data integrity or system availability. The attack requires network access via HTTP and human interaction from a user other than the attacker, which reduces the likelihood of exploitation. No known exploits in the wild have been reported to date.

Oracle has included this vulnerability in its April 2026 Critical Patch Update advisory. However, the advisory content provided does not explicitly confirm the availability of a specific patch for CVE-2026-34321. Customers should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpuapr2026.html for the latest patch availability and installation instructions. Oracle strongly recommends applying all relevant Critical Patch Update security patches without delay to mitigate this and other vulnerabilities. Until a patch is applied, organizations should be aware of the requirement for human interaction in exploitation and consider limiting network exposure of the affected application where feasible.