EUVD-2026-24428
GHSA-cj86-2v89-gm24
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-exploitable with no authentication per description and provided vector; partial C/I impacts match scoped data read/write without full system compromise or availability loss.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in the Oracle Life Sciences InForm product of Oracle Life Science Applications (component: App Server). Supported versions that are affected are 7.0.1.0 and 7.0.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Life Sciences InForm. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Life Sciences InForm accessible data as well as unauthorized read access to a subset of Oracle Life Sciences InForm accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
AnalysisAI
Unauthenticated network exploitation of the Oracle Life Sciences InForm App Server (versions 7.0.1.0 and 7.0.1.1) allows remote attackers to read a subset of clinical trial application data and perform unauthorized insert, update, or delete operations via HTTP - with no credentials or user interaction required. Rooted in CWE-284 (Improper Access Control) and tagged as an Authentication Bypass, the App Server fails to enforce access controls on certain endpoints, confirmed by Oracle in the April 2026 Critical Patch Update. No public exploit code or active exploitation has been identified; EPSS sits at 0.03% (8th percentile), though SSVC flags the attack as automatable.
Technical ContextAI
Oracle Life Sciences InForm is an electronic data capture (EDC) platform used to collect and manage clinical trial data, subject to stringent regulatory requirements (e.g., FDA 21 CFR Part 11). The vulnerability resides in its App Server component, identified by CPE cpe:2.3:a:oracle_corporation:oracle_life_sciences_inform. CWE-284 (Improper Access Control) indicates the server fails to correctly verify whether an incoming HTTP request is authorized before granting access to data operations - a class of flaw where protected resources or API endpoints are reachable without any credential challenge. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation is entirely network-driven over HTTP, requires no special conditions, and needs no privilege escalation - consistent with the Authentication Bypass tag. Impacted operations are limited to partial confidentiality (read some data) and partial integrity (modify some data); availability is not impacted, suggesting the flaw affects specific data access paths rather than the service itself.
RemediationAI
Apply the patch provided in the Oracle Critical Patch Update for April 2026, available at https://www.oracle.com/security-alerts/cpuapr2026.html. The exact patched version number beyond the CPU cycle is not independently confirmed from available data - consult the Oracle advisory directly for the specific build to upgrade to. If immediate patching is not feasible, restrict network access to the InForm App Server to trusted clinical site VPNs and internal networks only, since the attack vector is HTTP over the network; exposure reduction directly negates the AV:N attack vector. Additionally, deploy WAF rules to require session authentication tokens on all App Server data endpoints as a short-term compensating control - note this may break unauthenticated integration flows and should be tested. Enable comprehensive audit logging on the App Server to detect unauthorized read or write operations during the patching window, which also supports regulatory incident documentation requirements.
More in Oracle Life Sciences Inform
View allSame weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today