Introduction
A newly disclosed vulnerability in Oracle HTTP Server's Core component lets an unauthenticated attacker read and manipulate critical data across the web tier and potentially into backend systems, without triggering availability alerts. CVE-2026-34291 is scored at CVSS 8.7 with a scope change designation. It is a significant risk for organizations that run Oracle Fusion Middleware as the front door to their application infrastructure, mostly because successful exploitation leaves no obvious service disruption footprint.
Technical information
CVE-2026-34291 affects the Core component of Oracle HTTP Server. Oracle HTTP Server is the part of the Oracle Fusion Middleware stack that typically runs as the web tier in front of Oracle WebLogic Server and other application components. The vulnerability is present in supported versions 12.2.1.4.0 and 14.1.2.0.0.
CVSS vector breakdown
The full CVSS 3.1 vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N. Metric by metric:
- Attack Vector (AV:N): The vulnerability is exploitable remotely over the network via HTTP. No local or adjacent network access is required.
- Attack Complexity (AC:H): Exploitation is difficult and requires conditions beyond the attacker's direct control. This is the main thing that keeps the flaw from being trivially exploitable.
- Privileges Required (PR:N): No authentication is needed. Anything on the network that can reach the Oracle HTTP Server over HTTP can attempt exploitation.
- User Interaction (UI:N): A legitimate user does not need to do anything to trigger the vulnerability.
- Scope (S:C): This is the most consequential metric. A "Changed" scope means the vulnerability lives in Oracle HTTP Server, but successful exploitation can affect resources managed by other authorization authorities. In practice, the blast radius extends beyond the web tier into backend systems or integrated Oracle components.
- Confidentiality (C:H): An attacker can gain unauthorized access to critical data, or complete access to all data the Oracle HTTP Server can reach.
- Integrity (I:H): An attacker can create, delete, or modify critical data without authorization.
- Availability (A:N): There is no availability impact. The system stays up during and after exploitation, so standard uptime monitoring and availability checks will not detect this attack.
Attack surface and exploitation context
The attack protocol is HTTP, so the vulnerability is exposed on whatever port Oracle HTTP Server listens on (commonly port 80 or 443). Oracle HTTP Server frequently sits at the network perimeter as a reverse proxy or load balancer for Oracle WebLogic and other Fusion Middleware components, which means the attack surface is often directly internet facing.
The scope change matters most here. Oracle HTTP Server is a gateway to backend application servers, databases, and middleware services. A changed-scope vulnerability in its Core component suggests that an attacker who compromises the HTTP Server layer could use that position to access or modify data in the downstream systems the HTTP Server proxies or connects to. That fits how Oracle Fusion Middleware deployments are built: the HTTP Server handles SSL termination, request routing, and sometimes authentication enforcement for backend services.
No availability impact (A:N) plus high confidentiality and integrity impacts adds up to a dangerous detection gap. An attacker exploiting this vulnerability would be reading and modifying data silently, without any service disruption to set off operational alerts.
Related vulnerabilities in the same patch cycle
The April 2026 CPU fixes several other Oracle HTTP Server vulnerabilities that share the same affected versions. They help put the overall risk in context:
| CVE ID | Component | Remote Exploit without Auth | CVSS Score |
|---|---|---|---|
| CVE-2026-34291 | Core | Yes | 8.7 |
| CVE-2025-58098 | Core (Apache HTTP Server) | No | 8.3 |
| CVE-2024-43394 | Core (Apache HTTP Server) | Yes | 7.5 |
| CVE-2025-59775 | Core (Apache HTTP Server) | Yes | 7.5 |
| CVE-2025-65082 | Core (Apache HTTP Server) | Yes | 6.5 |
CVE-2026-34291 has the highest score in this group and is the only one with a scope change, which makes it the most serious of the Oracle HTTP Server fixes in this cycle.
Patch information
Oracle fixed CVE-2026-34291 in the April 2026 Critical Patch Update (CPU), officially released on April 21, 2026. This quarterly CPU addresses 483 new security vulnerabilities across Oracle's entire product portfolio, with 59 patches specifically for the Oracle Fusion Middleware family.
The vulnerability is in the Core component of Oracle HTTP Server and affects versions 12.2.1.4.0 and 14.1.2.0.0. The risk matrix in Oracle's verbose CPU advisory lists CVE-2026-34291 as a standalone entry in the Oracle Fusion Middleware section.
Oracle HTTP Server is closed-source proprietary software, so no public code-level diff or commit is available for this fix. Oracle delivers the patch only through My Oracle Support (MOS). Administrators should check the Fusion Middleware Patch Availability Document (MOS Doc ID 2806740.1) for specific patch numbers and installation guidance. Oracle's CPU patches for Fusion Middleware are generally cumulative, meaning they build on prior CPU patches.
One of the upstream patch check systems suggested that CVE-2026-33870 (a Netty HTTP request smuggling flaw) also addressed CVE-2026-34291. The verbose CPU risk matrix does not confirm this. CVE-2026-33870 appears under the Oracle Database Server section (Clusterware/Micronaut component), where its patch addresses CVE-2026-33013, not CVE-2026-34291. The two CVEs target entirely different Oracle products and components.
Organizations running Oracle HTTP Server 12.2.1.4.0 or 14.1.2.0.0 should apply the April 2026 CPU patch, which is the only vendor-sanctioned remediation for this vulnerability.
Affected systems and versions
These Oracle HTTP Server versions are confirmed affected:
- Oracle HTTP Server 12.2.1.4.0 (part of Oracle Fusion Middleware)
- Oracle HTTP Server 14.1.2.0.0 (part of Oracle Fusion Middleware)
The vulnerable component is Core, and the attack protocol is HTTP. Any deployment on these versions where Oracle HTTP Server is reachable over the network is potentially at risk. Because of the scope change, downstream systems that Oracle HTTP Server proxies or integrates with should also be treated as inside the blast radius.
Vendor security history
Oracle handles vulnerabilities through its quarterly Critical Patch Update program. The April 2026 CPU alone contains 483 new security patches, a number that reflects both the size of Oracle's product portfolio and the steady volume of security issues across it. In this one update cycle, Oracle Fusion Middleware received 59 new security patches, 46 of them for vulnerabilities that are remotely exploitable without authentication. Oracle has publicly acknowledged that they continue to receive reports of attempts to exploit vulnerabilities for which patches have already been released, so applying patches promptly matters across their products.
