CVE-2026-34274

OVERVIEW CVE-2026-34274 is an unauthenticated remote vulnerability affecting the Oracle Configurator component within Oracle E-Business Suite versions 12.2.3 through 12.2.15. The vulnerability exists in the User Interface layer and can be exploited over the network via HTTP protocol without requiring valid credentials. SEVERITY The vulnerability carries a CVSS 3.1 score of 6.1 (MEDIUM severity) with a network-based attack vector requiring low complexity and no privileges, though user interaction is necessary. Successful exploitation results in unauthorized read access to sensitive data within Oracle Configurator and potential unauthorized modification or deletion of accessible data. The scope is classified as changed, meaning impacts extend beyond the vulnerable component to other connected systems. EXPLOITATION STATUS Current exploitation activity remains minimal. The vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and is not on the Hot List for active threats. The EPSS score of 0.00027 indicates this CVE is in the lowest percentile of likelihood for real-world exploitation compared to all known vulnerabilities, suggesting limited community attention and no readily available public exploit code at this time.