EUVD-2026-24426
GHSA-62mx-j2c2-7953
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Network-accessible authentication flaw with no credentials required but mandatory victim interaction; partial C/I/A impacts reflect limited unauthorized data access and partial DOS consistent with description.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in the Oracle Life Sciences InForm product of Oracle Life Science Applications (component: IDM Authentication). Supported versions that are affected are 7.0.1.0 and 7.0.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Life Sciences InForm. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Life Sciences InForm accessible data as well as unauthorized read access to a subset of Oracle Life Sciences InForm accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Life Sciences InForm. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).
AnalysisAI
Improper access control in the IDM Authentication component of Oracle Life Sciences InForm 7.0.1.0 and 7.0.1.1 exposes the platform to unauthenticated network-based attacks over HTTP that require victim user interaction to succeed. Successful exploitation yields unauthorized partial read, write/delete, and denial-of-service impact against InForm clinical trial data. No public exploit code exists and no active exploitation has been identified; EPSS at 0.03% (9th percentile) and SSVC exploitation status of 'none' confirm minimal real-world threat at this time.
Technical ContextAI
Oracle Life Sciences InForm is an enterprise clinical trial data collection and management platform used by pharmaceutical and contract research organizations. The vulnerable component is the IDM (Identity Management) Authentication subsystem, which handles access control for user sessions over HTTP. The root cause is CWE-284 (Improper Access Control), indicating that the authentication layer fails to correctly enforce access restrictions - a class of flaw that can manifest as authentication bypass, insufficient authorization checks, or broken session validation. Affected versions are confirmed as 7.0.1.0 and 7.0.1.1 per Oracle's April 2026 CPU and EUVD-2026-24426 (CPE: cpe:2.3:a:oracle_corporation:oracle_life_sciences_inform:*:*:*:*:*:*:*:*). The CVSS vector AV:N/AC:L indicates the service is reachable over the network without special access conditions, consistent with a web-facing authentication endpoint.
RemediationAI
Apply Oracle's Critical Patch Update for April 2026, which addresses this vulnerability in Oracle Life Sciences InForm; the advisory is available at https://www.oracle.com/security-alerts/cpuapr2026.html. An exact patched release version is not stated in the available references beyond the CPU itself - organizations should contact Oracle Support to identify the specific build that resolves this CVE. As a compensating control pending patching, restrict HTTP access to the InForm IDM Authentication endpoint to trusted internal networks using perimeter firewall rules or a web application firewall, reducing exposure given the AV:N attack vector; note this may impact legitimate remote user workflows and should be coordinated with clinical operations teams. Because exploitation requires human interaction (UI:R), user awareness guidance about phishing or malicious link campaigns targeting InForm users provides an additional defensive layer with minimal operational trade-off.
More in Oracle Life Sciences Inform
View allSame weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today