EUVD-2026-79423
GHSA-x6wv-qv84-p8mx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Oracle Forms Services endpoint
-
DeliverySend crafted HTTP request
-
ExploitBypass authentication (CWE-287)
-
ExecutionGain control of Forms Services
-
ImpactRead/modify data and disrupt availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the Oracle Forms Services component (C/S, Charmode) of Oracle Fusion Middleware Oracle Forms versions 12.2.1.19.0 and 14.1.2.0.0. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are required beyond network HTTP reachability of the Forms Services endpoint - remote unauthenticated exploitation against affected default configurations of Oracle Forms is possible, with no authentication and no user interaction. The primary limiting factor is exposure: an attacker must be able to reach the Forms Services HTTP listener, so instances restricted to internal/segmented networks or fronted by authenticating reverse proxies are less exposed. Exploitation is also gated to the two named versions. |
| Impact | This is a high-priority patch candidate. The Oracle-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes a genuinely pre-authentication, network-reachable, low-complexity flaw yielding full compromise ("takeover") of Oracle Forms, and Oracle explicitly characterizes it as "easily exploitable" - signals that are internally consistent and well-calibrated (a real pre-auth RCE-class issue rather than an inflated score). CWE-287 (Improper Authentication) aligns with the "Authentication Bypass" tag and the PR:N metric. That said, no independent exploitation signals are available: EPSS is not provided, the CVE is NOT in CISA KEV, and no public POC is identified - so at time of analysis this is 'no public exploit identified at time of analysis.' There is no SSVC decision data in the input. The gap between a maximum-tier severity and the absence of any exploitation-probability signal means the score reflects potential impact, not confirmed activity; treat it as urgent-to-patch based on impact and pre-auth exposure, while recognizing exploitation in the wild is not evidenced. Oracle's CPU advisory carries zero technical detail, so the exact vulnerable code path and attack primitive cannot be independently verified. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach an internet- or network-exposed Oracle Forms Services endpoint sends crafted HTTP traffic that bypasses authentication (CWE-287) and gains full control of the Oracle Forms instance, reading and altering data and disrupting availability. Because CVSS is PR:N/UI:N/AC:L and Oracle calls it "easily exploitable," no credentials or user interaction are needed. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated remote attackers with HTTP reachability to the Oracle Forms Services listener can bypass authentication and take over Oracle Forms deployments in Oracle Fusion Middleware versions 12.2.1.19.0 and 14.1.2.0.0, specifically the Forms Services, C/S, and Charmode components. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), matching our independent assessment, meaning no credentials and no user interaction are required and the only practical precondition is network access to the Forms endpoint on default configurations. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a high-priority patch candidate - particularly for any instance exposed to the internet or to untrusted internal segments - rather than a currently exploited threat.
RemediationAI
Apply the fix published in Oracle's Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspusep2026.html, which is the vendor-recommended remediation for this issue; the provided data enumerates no specific patched version number, so consult that advisory for the exact fixed build for Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 and validate against it rather than assuming a version. Until the update is applied, the highest-value compensating control is reducing reachability: block external access to the Forms Services HTTP listener (the frmservlet endpoint) and restrict it to trusted networks, which is the single precondition the CVSS vector identifies, at the trade-off of breaking legitimate remote user access unless VPN or an authenticating reverse proxy is put in front of it. Placing an authenticating reverse proxy or WAF rule set in front of Forms Services adds a credential check ahead of the vulnerable pipeline, but can break non-browser client/server and Charmode traffic that does not carry browser session semantics, so test before enforcing. If the legacy browser-compatible Charmode presentation is not required, disabling that rendering mode in the Forms configuration (for example the baseHTMLcharmode-style settings in formsweb.cfg) removes one of the named attack surfaces at the cost of losing client-compatible UI rendering for existing users, and monitoring Forms listener logs for unauthenticated or anomalous requests to the servlet endpoint provides detection while the patch is staged.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Forms is a rapid application development and runtime platform in Oracle Fusion Middleware that presents Forms applications to users through an HTTP listener, typically a Java servlet (frmservlet) hosted on Oracle WebLogic Server or Oracle HTTP Server. The affected components named in the advisory - Forms Services, C/S (client/server), and Charmode - cover both the modern browser rendering path and the legacy presentation modes that emulate the original fat-client runtime over HTTP. The root cause class is CWE-287 (Improper Authentication): the authentication check in the request-handling pipeline can be bypassed, so a crafted HTTP request reaches application logic or administrative functionality without valid credentials. That maps directly onto the CVSS vector AV:N/AC:L/PR:N/UI:N, which requires only network reachability of the Forms listener, and onto the scope-unchanged C:H/I:H/A:H impact rating, since a successful bypass yields read, modify, and denial impact across the Oracle Forms application itself. Exploitation is further gated to the two named versions, as confirmed by EUVD (EUVD-2026-79423), which lists Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 as the affected releases; Oracle published the corresponding details in its Critical Security Patch Update advisory. The primary limiting factor is exposure rather than attack complexity - instances bound to internal networks only, or fronted by an authenticating reverse proxy, are materially less reachable.
Know when Forms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor describes easily exploitable, unauthenticated, network HTTP attack yielding full product takeover, so PR:N/AC:L/AV:N with C:H/I:H/A:H; impact confined to Forms itself, so S:U.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. Successful attacks of this vulnerability can result in takeover of Oracle Forms. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Fusion Middleware deployments running Forms Services (12.2.1.19.0 and 14.1.2.0.0, including Forms Services, C/S, and Charmode components) are exposed to an unauthenticated authentication bypass that allows an attacker with network reachability to fully take over the Forms environment. Because no credentials or user interaction are required, any internet-facing or broadly reachable Forms endpoint represents a direct path to compromise of the applications and data those forms serve. Leadership should treat this as a priority remediation item for externally exposed instances, while noting that no public exploit code or confirmed active exploitation was identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to the Forms Services listener using firewalls, security groups, or network segmentation so only trusted sources can reach the endpoint; place the listener behind a reverse proxy or WAF with allow-listing and request inspection; disable the Charmode and C/S components where not operationally required; enforce least-privilege network paths for internal segments; and enable enhanced logging and monitoring of Forms authentication and session activity to detect unauthorized access attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated remote takeover of Oracle Forms is possible in the Forms Services (C/S, Charmode) component of Oracle Fu
Stored cross-site scripting in the Forms WordPress plugin (versions before 3.0.2) allows an unauthenticated attacker to
Unauthenticated remote takeover of Oracle Forms is achievable through the Forms Services C/S Charmode component in versi
Authentication bypass in Oracle Forms (Oracle Fusion Middleware) 12.2.1.19.0 and 14.1.2.0.0 lets an unauthenticated, net
Unrestricted network access to Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 allows unauthenticated attackers to bypass authen
Full takeover of Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 is achievable by an unauthenticated remote attacker exploiting
Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a r
Unauthenticated remote code execution in the Balbooa Forms extension for Joomla (versions before 2.4.3.4) lets a visitor
The Forms WordPress plugin before 1.12.3 did not sanitise its input fields, leading to Stored Cross-Site scripting issue
Improper authentication in the Oracle Forms Client/Server (C/S) Charmode runtime allows an unauthenticated, network-reac
Unauthenticated path traversal in Balbooa Forms (a Joomla extension) before 2.4.3.4 allows remote attackers to exfiltrat
Authentication bypass in Oracle Forms (component: Forms Services, C/S, Charmode) allows an unauthenticated remote attack
Exploit-DB