This vulnerability affects Oracle Life Sciences InForm versions 7.0.1.0 and 7.0.1.1, specifically the IDM Authentication component. It is exploitable remotely over HTTP without authentication, but requires user interaction from a third party. Exploitation can result in unauthorized read and write access to some data and partial denial of service conditions. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) reflects network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and low impacts on confidentiality, integrity, and availability. The vulnerability is listed in Oracle's April 2026 Critical Patch Update advisory, which addresses numerous vulnerabilities across Oracle products, but does not explicitly confirm patch availability or remediation status for this specific issue.

Successful exploitation can lead to unauthorized read access to some data, unauthorized update, insert, or delete operations on accessible data, and partial denial of service of Oracle Life Sciences InForm. The impact affects confidentiality, integrity, and availability to a limited extent. Exploitation requires user interaction from a person other than the attacker, which may limit the ease of exploitation despite the vulnerability being remotely accessible without authentication.

Oracle has included this vulnerability in their April 2026 Critical Patch Update advisory, which contains numerous security patches across multiple products. However, the advisory content provided does not explicitly confirm the availability of a specific patch or official fix for CVE-2026-34323. Therefore, patch status is not yet confirmed—users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cpuapr2026.html for the latest remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly to mitigate known vulnerabilities. Until a patch is confirmed and applied, organizations should consider limiting network exposure of Oracle Life Sciences InForm and educate users to be cautious of interactions that could trigger exploitation.