CVE-2026-34324

Vulnerability in the Oracle Life Sciences InForm product of Oracle Life Science Applications (component: App Server). Supported versions that are affected are 7.0.1.0 and 7.0.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Life Sciences InForm. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Life Sciences InForm accessible data as well as unauthorized read access to a subset of Oracle Life Sciences InForm accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.oracle.com/security-alerts/cpuapr2026.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:oracle:life_sciences_inform:7.0.1.0:::::::*
	cpe:2.3:a:oracle:life_sciences_inform:7.0.1.1:::::::*

History

23 Apr 2026, 16:42

Type	Values Removed	Values Added
First Time		Oracle life Sciences Inform Oracle
References	~~() https://www.oracle.com/security-alerts/cpuapr2026.html -~~	() https://www.oracle.com/security-alerts/cpuapr2026.html - Vendor Advisory
CPE		cpe:2.3:a:oracle:life_sciences_inform:7.0.1.1:::::::* cpe:2.3:a:oracle:life_sciences_inform:7.0.1.0:::::::*

22 Apr 2026, 16:16

Type	Values Removed	Values Added
CWE		CWE-284

21 Apr 2026, 21:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-21 21:16

Updated : 2026-06-17 10:38

NVD link : CVE-2026-34324

Mitre link : CVE-2026-34324

CVE.ORG link : CVE-2026-34324

JSON object : View

Products Affected

oracle

life_sciences_inform

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-34324", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34324", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T15:08:08.738831Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "secalert_us@oracle.com", "affectedData": [{"vendor": "Oracle Corporation", "product": "Oracle Life Sciences InForm", "versions": [{"status": "affected", "version": "7.0.1.0", "versionType": "semver"}, {"status": "affected", "version": "7.0.1.1", "versionType": "semver"}]}]}], "published": "2026-04-21T21:16:38.080", "references": [{"url": "https://www.oracle.com/security-alerts/cpuapr2026.html", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle Life Sciences InForm product of Oracle Life Science Applications (component: App Server). Supported versions that are affected are 7.0.1.0 and 7.0.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Life Sciences InForm. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Life Sciences InForm accessible data as well as unauthorized read access to a subset of Oracle Life Sciences InForm accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)."}], "lastModified": "2026-06-17T10:38:50.930", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:life_sciences_inform:7.0.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A1A0C83-890A-4761-93FB-4CBC1A06D14D"}, {"criteria": "cpe:2.3:a:oracle:life_sciences_inform:7.0.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "762889CE-F93C-41F4-876C-CBA8CF273EB9"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}