EUVD-2026-79427
GHSA-82cq-wvc6-h3gw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Oracle Forms HTTP endpoint
-
ExploitSend crafted request bypassing authentication
-
ExecutionAchieve Forms Services takeover
-
ImpactPivot across scope boundary to adjacent products
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a network-reachable Oracle Forms Services (C/S, Charmode) instance running affected versions 12.2.1.19.0 or 14.1.2.0.0, exposed over HTTP. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special privileges are needed - this is a remote unauthenticated takeover against the affected Forms Services configuration. The primary limiting factors are deployment-side: the specific Forms Services Client/Server Charmode component must be present and its HTTP interface must be reachable by the attacker, so instances isolated from untrusted networks or not running the Charmode C/S configuration are not exposed. |
| Impact | This is a genuine top-priority vulnerability by every available signal. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) yields a perfect 10.0: remote, network-reachable over HTTP, no authentication (PR:N), no user interaction, low attack complexity, and full confidentiality/integrity/availability impact combined with a scope change (S:C) - meaning compromise of Oracle Forms can extend to additional products beyond the vulnerable component. CWE-287 (Authentication Bypass) is consistent with the 'unauthenticated attacker' language, indicating a pre-auth takeover rather than a post-auth privilege issue. Countervailing signals temper urgency: no CISA KEV listing, no public POC, and no EPSS score are present in the input, so there is no evidence of active or imminent mass exploitation yet. Oracle's advisory (cspusep2026) provides zero technical detail, which is standard for Oracle CPUs and slightly limits independent validation of the mechanism. Net: the score is well-calibrated for a pre-auth RCE-class flaw and should be patched immediately despite the absence of exploitation evidence - the perfect score plus scope change makes this an attractive future target. Note the near-identical sibling CVE-2026-83099-vs-CVE-2026-83094: the same Oracle Forms / Forms Services C/S Charmode component carries a 9.8 (S:U) advisory this cycle, so this 10.0 differs only by the scope-change judgment. |
| Exploit ScenarioDerived | An unauthenticated attacker reachable over the network sends a crafted HTTP request to an exposed Oracle Forms Services (C/S, Charmode) endpoint, bypassing authentication (CWE-287) to gain full control of Oracle Forms. Because the vulnerability carries a scope change, the attacker can then pivot to impact additional connected products beyond Forms itself. No public exploit code is identified at time of analysis, and exploitation requires no privileges or user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated remote takeover of Oracle Forms is possible in the Forms Services (C/S, Charmode) component of Oracle Fusion Middleware running versions 12.2.1.19.0 and 14.1.2.0.0. An attacker who can reach the Forms HTTP interface with no credentials, no user interaction, and no special privileges can bypass authentication and gain full control of the affected deployment, and the CVSS scope-change flag (S:C) indicates the compromise can significantly impact additional products tied to the same environment. The vendor-rated CVSS 3.1 base score is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), and the flaw is described as easily exploitable, though no public exploit identified at time of analysis.
RemediationAI
Patch availability is per vendor advisory: apply the Oracle Critical Security Patch Update referenced at https://www.oracle.com/security-alerts/cspusep2026.html for Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 - an exact fixed build number is not specified in the provided data, so confirm the corrected version in the advisory before rolling out, and expect a Forms Services restart as part of the update. If patching cannot be performed immediately, reduce exposure by blocking network access to the Forms Services HTTP listener from untrusted networks using firewall rules or segmentation, since the vector requires network reachability; the trade-off is loss of remote access for legitimate Forms users, so scope rule changes to the affected listener and allow-list only trusted client subnets. Where the Charmode client/server mode is not operationally required, disable that C/S configuration entirely, which removes the vulnerable code path at the cost of breaking legacy thick-client Forms sessions. Because exploitation requires no authentication or user interaction, log and alert on anomalous HTTP requests to the Forms endpoint and treat any successful auth-bypass indicator as a full compromise of the middleware tier, including possible lateral impact implied by the scope-change rating.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause falls under CWE-287 (Improper Authentication), meaning the Forms Services Charmode client/server path fails to correctly verify caller identity before granting access to protected functionality. Oracle Forms is a Fusion Middleware application-development and runtime platform; the affected subcomponent is the Services C/S Charmode listener, which exposes an HTTP interface for thick-client and legacy Charmode sessions. Because the CVSS vector carries S:C (scope change), the vulnerable component can be used to affect resources beyond its own security authority - in practice an attacker who lands on the Forms service may reach consolidated middleware assets in the same deployment, amplifying impact beyond the Forms tier itself. The only prerequisites are network reachability of the Forms HTTP endpoint and the presence of the Charmode C/S configuration on a supported affected version; no CPE strings were supplied in the source data, so product identification rests on the vendor attribution (reported by secalert_us@oracle.com) and the EUVD record EUVD-2026-79427, which lists Oracle Forms 12.2.1.19.0 and 14.1.2.0.0.
Know when Forms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Description confirms unauthenticated (PR:N) network HTTP access with no interaction, full triad impact and explicit scope change to additional products (S:C), giving 10.0.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. While the vulnerability is in Oracle Forms, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Forms. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Executive ViewAI
Oracle Fusion Middleware Forms Services - specifically the C/S and Charmode components in versions 12.2.1.19.0 and 14.1.2.0.0 - can be fully taken over by an attacker who needs no credentials, no user interaction, and no prior access, simply by reaching the Forms HTTP interface. Because the flaw crosses security boundaries, a successful compromise does not stay contained to the Forms deployment; it can extend to other systems sharing that environment, making this a potential enterprise-wide exposure rather than a single-application incident. With no vendor patch available and a maximum severity rating, leadership should treat any internet-reachable or broadly networked Forms instance as an active, unresolved risk requiring immediate containment.
No vendor-released patch identified at time of analysis. Interim mitigations: block or strictly allowlist network access to the Forms HTTP interface at the perimeter and host firewall; disable the Charmode and C/S listeners where not required; place the service behind VPN-only access; deploy WAF/IPS virtual patching rules for the Forms endpoints; network-segment affected deployments to limit scope-change propagation; enable verbose logging and continuous monitoring of the Forms HTTP interface for authentication-bypass attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Stored cross-site scripting in the Forms WordPress plugin (versions before 3.0.2) allows an unauthenticated attacker to
Unauthenticated remote takeover of Oracle Forms is achievable through the Forms Services C/S Charmode component in versi
Unauthenticated remote attackers with HTTP reachability to the Oracle Forms Services listener can bypass authentication
Authentication bypass in Oracle Forms (Oracle Fusion Middleware) 12.2.1.19.0 and 14.1.2.0.0 lets an unauthenticated, net
Unrestricted network access to Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 allows unauthenticated attackers to bypass authen
Full takeover of Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 is achievable by an unauthenticated remote attacker exploiting
Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a r
Unauthenticated remote code execution in the Balbooa Forms extension for Joomla (versions before 2.4.3.4) lets a visitor
The Forms WordPress plugin before 1.12.3 did not sanitise its input fields, leading to Stored Cross-Site scripting issue
Improper authentication in the Oracle Forms Client/Server (C/S) Charmode runtime allows an unauthenticated, network-reac
Unauthenticated path traversal in Balbooa Forms (a Joomla extension) before 2.4.3.4 allows remote attackers to exfiltrat
Authentication bypass in Oracle Forms (component: Forms Services, C/S, Charmode) allows an unauthenticated remote attack
Exploit-DB