Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 12.2.9-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data as well as unauthorized read access to a subset of Oracle Applications Framework accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Applications Framework. CVSS 3.1 Base Score 4.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).
References
| Link | Resource |
|---|---|
| https://www.oracle.com/security-alerts/cpuapr2026.html | Vendor Advisory |
Configurations
History
24 Apr 2026, 14:29
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Oracle applications Framework
Oracle |
|
| CPE | cpe:2.3:a:oracle:applications_framework:*:*:*:*:*:*:*:* | |
| References | () https://www.oracle.com/security-alerts/cpuapr2026.html - Vendor Advisory |
22 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-284 |
21 Apr 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-21 21:16
Updated : 2026-04-24 14:29
NVD link : CVE-2026-34298
Mitre link : CVE-2026-34298
CVE.ORG link : CVE-2026-34298
JSON object : View
Products Affected
oracle
- applications_framework
CWE
CWE-284
Improper Access Control