EUVD-2026-79426
GHSA-fc3m-f6qr-cq3v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Oracle Forms Services HTTP endpoint
-
DeliverySend crafted pre-auth HTTP request
-
ExploitBypass authentication (CWE-287)
-
ExecutionAchieve full Forms compromise
-
ImpactTake over confidentiality, integrity, availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a reachable Oracle Forms Services deployment running in the C/S (client/server) Charmode configuration, versions 12.2.1.19.0 or 14.1.2.0.0, with its HTTP interface accessible to the attacker. Per the vector (AV:N/AC:L/PR:N/UI:N) there are no authentication, user-interaction, or special-complexity prerequisites - exploitation is remote and unauthenticated against an affected instance. The primary limiting factors are deployment-specific: the vulnerable C/S Charmode component is a legacy Forms mode that is not universally deployed, and network exposure of the Forms HTTP endpoint (versus internal-only reachability) materially bounds real-world attack surface. |
| Impact | The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) is internally consistent and well-calibrated for a genuine pre-authentication, network-reachable full-takeover flaw in Oracle Forms Services (C/S, Charmode). Oracle explicitly describes it as 'easily exploitable' by an 'unauthenticated attacker with network access via HTTP,' which aligns with AC:L/PR:N/UI:N and CWE-287 (Authentication Bypass / Improper Authentication). However, the real-world-risk picture is dominated by MISSING corroborating signals: no EPSS score is provided, CISA KEV status is absent (no evidence of active exploitation), and no public POC is referenced. The sole reference is Oracle's September 2026 Critical Patch Update landing page (cspusep2026.html), which per Oracle convention carries ZERO technical detail - no root cause, no exploit primitive, no affected endpoint. So while the CVSS ceiling is critical and defensible on paper, there is no independent confirmation of exploitation or exploit availability, and severity rests entirely on the vendor's self-reported vector. Treat as a high-priority PATCH candidate (pre-auth RCE-class on an enterprise middleware component), but note that Oracle Forms C/S Charmode is a legacy deployment mode with a narrower footprint than mainstream WebLogic, so blanket urgency should be tempered by whether this specific component is actually exposed. This is a near-identical sibling of CVE-2026-83094 (same product/component, same vector, same CPU). |
| Exploit ScenarioDerived | A remote, unauthenticated attacker reaches an internet- or network-exposed Oracle Forms Services (C/S, Charmode) endpoint over HTTP and sends a crafted request that bypasses authentication, gaining full control of the Oracle Forms instance (confidentiality, integrity, and availability all fully impacted). No user interaction or prior credentials are required. No public exploit code is identified at time of analysis, and Oracle's CPU advisory provides no technical detail to build one from. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Full takeover of Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 is achievable by an unauthenticated remote attacker exploiting an improper-authentication flaw (CWE-287) in the Forms Services C/S (Charmode) component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) confirms there are no credential, user-interaction, or special-complexity prerequisites - only HTTP reachability to an affected Forms deployment is required. No public exploit code has been identified at time of analysis, and real-world exposure is bounded by how widely the legacy C/S Charmode mode is deployed and whether the Forms HTTP endpoint is exposed beyond the internal network.
RemediationAI
Oracle delivers Fusion Middleware security fixes through its Critical Security Patch Update cycle, and the advisory at https://www.oracle.com/security-alerts/cspusep2026.html is the authoritative source for the fix covering Forms 12.2.1.19.0 and 14.1.2.0.0; no specific patched version number is enumerated in the supplied intelligence, so patch availability and the exact fixed release should be confirmed directly against that advisory rather than assumed. Because the vulnerable code resides in the legacy C/S 'Charmode' path, the strongest immediate compensating control is to disable that mode or stop serving it where no legacy client depends on it, which removes the affected component entirely - the trade-off being that any remaining C/S Forms clients will stop functioning. In parallel, restrict network access to the Forms Services HTTP listener so that only trusted application-tier hosts, management networks, or VPN clients can reach it, ideally fronted by an authenticating reverse proxy or WAF; note this only reduces reachability and does not remediate the underlying authentication bypass, and aggressive filtering can break legitimate thin-client users. Finally, since this is a pre-authentication flaw, monitor Forms listener logs for anomalous unauthenticated requests to Charmode/Forms Services endpoints, as there is no legitimate unauthenticated traffic profile to blend into.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a broken-authentication defect (CWE-287) in Oracle Forms Services, the server-side runtime of Oracle Fusion Middleware Forms, specifically in the C/S (client/server) 'Charmode' code path that brokers communication between Forms clients and the Forms runtime over HTTP. Charmode is a legacy compatibility mode retained for older client deployments rather than the modern thin-client path, so the vulnerable code is only present when that mode is actually configured and served. Because authentication is not correctly enforced on that path, a remote, unauthenticated HTTP request can reach privileged Forms functionality and achieve complete compromise of the Forms instance, which is consistent with the assessed vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) - integrity, confidentiality and availability are all fully impacted with scope unchanged. The EUVD record (EUVD-2026-79426) scopes affected builds to Oracle Forms 12.2.1.19.0 and 14.1.2.0.0; no CPE strings were supplied in the intelligence set, so affected assets must be identified by installed product version and configuration rather than by automated CPE matching. The root-cause class matters operationally: because the failure is pre-authentication, any compensating control that relies on the attacker lacking credentials or interaction is ineffective, and defense must focus on reachability and elimination of the affected component.
Know when Forms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle states unauthenticated network HTTP access and easy exploitation with full takeover, supporting AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H; scope unchanged as compromise stays within Forms.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. Successful attacks of this vulnerability can result in takeover of Oracle Forms. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Forms deployments running versions 12.2.1.19.0 and 14.1.2.0.0 are exposed to a critical authentication bypass that can hand an unauthenticated attacker complete control of the Forms Services environment, with no patch currently available from the vendor. Because the flaw requires only network reachability and no credentials or user interaction, any Forms endpoint exposed beyond the internal network - including partner or legacy C/S Charmode integrations - represents a direct path to takeover of business-critical forms-based applications and the data they process. Leadership should treat this as a priority containment effort, since remediation depends on network isolation and configuration change rather than patching.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or block external and partner-facing access to the Forms Services HTTP endpoint and restrict it to trusted internal networks via firewall, load balancer, or reverse-proxy allow-lists; disable C/S (Charmode) mode where it is not operationally required; place affected endpoints behind an authenticating gateway or VPN so unauthenticated clients cannot reach Forms Services; segment affected hosts from sensitive back-end systems; and enable enhanced logging and monitoring of Forms Services authentication and Charmode traffic to detect exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated remote takeover of Oracle Forms is possible in the Forms Services (C/S, Charmode) component of Oracle Fu
Stored cross-site scripting in the Forms WordPress plugin (versions before 3.0.2) allows an unauthenticated attacker to
Unauthenticated remote takeover of Oracle Forms is achievable through the Forms Services C/S Charmode component in versi
Unauthenticated remote attackers with HTTP reachability to the Oracle Forms Services listener can bypass authentication
Authentication bypass in Oracle Forms (Oracle Fusion Middleware) 12.2.1.19.0 and 14.1.2.0.0 lets an unauthenticated, net
Unrestricted network access to Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 allows unauthenticated attackers to bypass authen
Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a r
Unauthenticated remote code execution in the Balbooa Forms extension for Joomla (versions before 2.4.3.4) lets a visitor
The Forms WordPress plugin before 1.12.3 did not sanitise its input fields, leading to Stored Cross-Site scripting issue
Improper authentication in the Oracle Forms Client/Server (C/S) Charmode runtime allows an unauthenticated, network-reac
Unauthenticated path traversal in Balbooa Forms (a Joomla extension) before 2.4.3.4 allows remote attackers to exfiltrat
Authentication bypass in Oracle Forms (component: Forms Services, C/S, Charmode) allows an unauthenticated remote attack
Exploit-DB