EUVD-2026-79421
GHSA-q8gj-v4g5-5rj2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Unauthenticated network-reachable HTTP bypass matches AV:N/PR:N/UI:N; scope change retained per vendor, confidentiality-only impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. While the vulnerability is in Oracle Forms, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Forms accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
AnalysisAI
Authentication bypass in Oracle Forms (component: Forms Services, C/S, Charmode) allows an unauthenticated remote attacker with HTTP access to reach data and functionality that should require a valid session, affecting versions 12.2.1.19.0 and 14.1.2.0.0. The flaw carries a CVSS 3.1 base score of 8.6 with a scope-change flag, meaning a compromise of Oracle Forms can pivot to impact other products connected to or served by the Forms tier. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Oracle Forms instance be reachable over the network on its HTTP listener and that a Forms application be deployed on the affected installation; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no credentials, no user interaction, and no special complexity are needed to trigger the bypass. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector is close to maximally favorable for an attacker: AV:N, AC:L, PR:N, UI:N, S:C, C:H - an unauthenticated, low-complexity, no-interaction information-disclosure path over the network, which is why the base score reaches 8.6 despite no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Oracle's guidance for this class of Fusion Middleware defect is to apply the patches released in the referenced Critical Security Patch Update (https://www.oracle.com/security-alerts/cspusep2026.html) for Oracle Forms 12.2.1.19.0 and 14.1.2.0.0; the inputs do not name an exact build number or patch ID, so confirm the target version against the advisory before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today