PT-2026-34126 · Oracle · Oracle Workflow+1

Published 2026-04-21 · Updated 2026-04-26 · CVE-2026-34302

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Workflow versions 12.2.3 through 12.2.15

Description An issue exists in the Workflow Loader component of the Oracle Workflow product. A high-privileged attacker with network access via HTTP can compromise Oracle Workflow, which may significantly impact additional products. Successful exploitation allows unauthorized update, insert, or delete access to certain accessible data and the ability to cause a partial denial of service (DoS), a condition where the system remains operational but some functions are unavailable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-34302

Affected Products

Oracle Workflow

Iworkflow

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-34302 · Security Note
• https://oracle.com/security-alerts/cpuapr2026.html · Vendor Advisory
• https://twitter.com/CVEnew/status/2048546637891637604 · Twitter Post