CVE-2026-34324
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability in Oracle Life Sciences InForm (App Server component) versions 7.0.1.0 and 7.0.1.1 allows an unauthenticated attacker with network access via HTTP to partially update, insert, or delete data and to gain unauthorized read access to a subset of data. CVSS 3.1 Base Score 6.5 (confidentiality and integrity impacts).
Risk Assessment
An attacker can modify or delete data without authentication and read some data, potentially compromising the integrity and confidentiality of clinical information. The risk is moderate but easily exploitable remotely.
Recommendation
Apply available Oracle patches for Oracle Life Sciences InForm and restrict network access to the App Server component to trusted sources. Monitor logs for unusual HTTP requests.
Other vulnerabilities in Oracle Life Sciences InForm
See all- CVE-2026-34323Medium
Vulnerability in Oracle Life Sciences InForm (component: IDM Authentication) affecting versions 7.0.1.0 and 7.0.1.1. An easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the product with human interaction, resulting in unauthorized update, insert or delete access, unauthorized read access, and partial denial of service.
- CVE-2025-62287Medium
Vulnerability in Oracle Life Sciences InForm (component: Web Server) version 7.0.1.0. Easily exploitable by an unauthenticated attacker with network access via HTTP, requiring user interaction. The attack may impact additional products (scope change) and result in unauthorized access to some InForm data (read, update, insert, delete). CVSS 6.1.
- CVE-2025-61885Medium
Vulnerability in Oracle Life Sciences InForm (Web Server component) version 7.0.1.0. A low-privileged attacker with network access via HTTP can compromise the product, resulting in unauthorized read access to a subset of data. CVSS 4.3 (Confidentiality impact).
Original NVD description (English source)
Vulnerability in the Oracle Life Sciences InForm product of Oracle Life Science Applications (component: App Server). Supported versions that are affected are 7.0.1.0 and 7.0.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Life Sciences InForm. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Life Sciences InForm accessible data as well as unauthorized read access to a subset of Oracle Life Sciences InForm accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS