CVE-2026-34323
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Vulnerability in Oracle Life Sciences InForm (component: IDM Authentication) affecting versions 7.0.1.0 and 7.0.1.1. An easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the product with human interaction, resulting in unauthorized update, insert or delete access, unauthorized read access, and partial denial of service.
Risk Assessment
An attacker could modify or delete data, gain unauthorized read access, and cause partial denial of service, impacting confidentiality, integrity, and availability.
Recommendation
Apply the Oracle Critical Patch Update fixes for Oracle Life Sciences InForm 7.0.1.0 and 7.0.1.1.
Other vulnerabilities in Oracle Life Sciences InForm
See all- CVE-2026-34324Medium
A vulnerability in Oracle Life Sciences InForm (App Server component) versions 7.0.1.0 and 7.0.1.1 allows an unauthenticated attacker with network access via HTTP to partially update, insert, or delete data and to gain unauthorized read access to a subset of data. CVSS 3.1 Base Score 6.5 (confidentiality and integrity impacts).
- CVE-2025-62287Medium
Vulnerability in Oracle Life Sciences InForm (component: Web Server) version 7.0.1.0. Easily exploitable by an unauthenticated attacker with network access via HTTP, requiring user interaction. The attack may impact additional products (scope change) and result in unauthorized access to some InForm data (read, update, insert, delete). CVSS 6.1.
- CVE-2025-61885Medium
Vulnerability in Oracle Life Sciences InForm (Web Server component) version 7.0.1.0. A low-privileged attacker with network access via HTTP can compromise the product, resulting in unauthorized read access to a subset of data. CVSS 4.3 (Confidentiality impact).
Original NVD description (English source)
Vulnerability in the Oracle Life Sciences InForm product of Oracle Life Science Applications (component: IDM Authentication). Supported versions that are affected are 7.0.1.0 and 7.0.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Life Sciences InForm. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Life Sciences InForm accessible data as well as unauthorized read access to a subset of Oracle Life Sciences InForm accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Life Sciences InForm. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS