EUVD-2026-79431
GHSA-hqgq-xq72-j5jm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privilege account access
-
DeliveryReach Forms Services over HTTP
-
ExploitSend crafted request to Charmode component
-
ExecutionCompromise Oracle Forms
-
ImpactPivot across scope boundary to additional products
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold HIGH privileges (PR:H) on the target and network access to the Oracle Forms Services component running in C/S Charmode over HTTP; affected versions are exactly Oracle Forms 12.2.1.19.0 and 14.1.2.0.0. The dominant limiting factor is the high-privilege prerequisite - this is not remotely exploitable by an unauthenticated actor, so the realistic threat is a privileged insider or an attacker who has already obtained elevated credentials. No user interaction is required (UI:N) and complexity is low (AC:L), but the scope change means a successful attack can extend impact to additional products beyond Oracle Forms. |
| Impact | This is a genuinely high-severity flaw but with an important limiter that raw score obscures. The vendor CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects a network-reachable, low-complexity path to full takeover of Oracle Forms with scope change, but critically requires PR:H - a high-privileged attacker already holding elevated access on the target. This is materially different from the pre-authentication (PR:N, 9.8) Oracle Forms sibling CVE-2026-83094 in the same September 2026 CPU: here the attacker must first be an authenticated, high-privilege operator, which sharply narrows the realistic threat population to insiders or attackers who have already compromised privileged credentials. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or automatable mass-exploitation. Oracle's CPU advisory (cspusep2026) provides zero technical detail, which is standard for Oracle and prevents independent verification of the vulnerability class (CWE is N/A). Net: treat this as a well-calibrated high-severity issue that should be patched in the normal CPU cycle, but it is NOT a drop-everything pre-auth internet-facing emergency - the PR:H requirement is the dominant risk-reducing factor. The 'Information Disclosure' tag understates the actual full-triad (C:H/I:H/A:H) takeover impact. |
| Exploit ScenarioDerived | An attacker who already holds high-privilege access to an Oracle Fusion Middleware environment (e.g., a malicious insider or an adversary who has compromised a privileged account) sends crafted HTTP requests to the Oracle Forms Services C/S Charmode component and achieves full takeover of Oracle Forms. Because the vulnerability carries a scope change, the compromise can significantly impact additional products beyond Oracle Forms itself. No public exploit code is identified at time of analysis, and exploitation is gated behind the required high-privilege foothold. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Full takeover of Oracle Forms is possible in the Forms Services component of Oracle Fusion Middleware for versions 12.2.1.19.0 and 14.1.2.0.0, where an attacker who already holds high privileges on the target and has HTTP network access to the Forms Services listener (including C/S and Charmode deployments) can achieve complete confidentiality, integrity, and availability impact and, because of a scope change, extend that impact to other products in the same deployment. The 9.1 CVSS base score reflects low attack complexity and no user interaction, but the PR:H prerequisite is the dominant limiter - this is not exploitable by an unauthenticated remote actor, so the realistic threat is a privileged insider or an attacker who has already obtained elevated credentials. No public exploit code or evidence of active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied with the source data.
RemediationAI
Apply the fix published in the Oracle security alert at https://www.oracle.com/security-alerts/cspusep2026.html, which covers CVE-2026-83103; Oracle's update advisories ship remediated builds for the affected 12.2.1.19.0 and 14.1.2.0.0 lines, and the exact patched build number was not independently confirmed from the provided data, so confirm the target release against the advisory before scheduling the upgrade. Because exploitation requires network access to the Forms Services HTTP listener, an effective interim control is to restrict that listener to trusted management/client networks via firewall or reverse-proxy rules - the trade-off is that legitimate C/S and Charmode clients outside the allowed ranges will be unable to connect, and disabling Charmode or C/S endpoints entirely (where the deployment can operate in web-only mode) removes the exposure but breaks legacy character-mode applications. In parallel, minimize, review, and rotate the accounts that hold the high privileges the vector requires (PR:H), since restricting the population of highly privileged Forms users directly reduces the attack surface and the insider risk the assessment identifies as the dominant limiter; audit and log HTTP requests to Forms Services for anomalous privileged actions. Patching remains the only complete fix, and the priority should be driven by the 9.1 score and the scope-change potential rather than by observed exploitation, since no public exploit code or KEV listing was identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Forms is a long-standing rapid application development and runtime component of Oracle Fusion Middleware, and Forms Services is the server-side runtime that serves Forms applications to clients. The affected component designation covers Forms Services along with its C/S (client/server) and Charmode (character-mode/legacy terminal-style) connectivity paths, which communicate over HTTP - consistent with the AV:N/PR:H/Low-complexity vector. No CWE identifier was assigned in the provided data, so the root-cause class is not formally classified; however, the assessed combination of PR:H (attacker must already be highly privileged), S:C (scope change, meaning the vulnerable component's compromise can affect resources outside its own security scope), and full C:H/I:H/A:H impact is characteristic of a privilege-boundary escape: an actor who already legitimately holds elevated access can leverage the Forms Services runtime to affect the wider Fusion Middleware stack rather than being contained to the Forms component itself. Note that the source data carries an 'Information Disclosure' tag, which conflicts with the C/I/A:H assessment; the tag appears to be generic advisory metadata and should not be used to downgrade the impact. No CPE entries were supplied, but ENISA EUVD independently enumerates the same two affected versions, corroborating the vendor statement.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network HTTP vector with low complexity but requires an existing high-privilege account (PR:H); full takeover yields C:H/I:H/A:H, and the vendor-stated cross-product impact justifies S:C.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Forms. While the vulnerability is in Oracle Forms, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Forms. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Executive ViewAI
Oracle Forms Services in Oracle Fusion Middleware (versions 12.2.1.19.0 and 14.1.2.0.0) contains a critical vulnerability that could give a privileged attacker full control of the component and extend impact to other integrated products. Because exploitation requires high privileges, the threat is primarily from malicious insiders or attackers who have already compromised elevated credentials. Leadership should act urgently to limit exposure, as a successful attack could result in complete data compromise and service disruption across the deployment.
No vendor-released patch identified at time of analysis. Interim mitigations include strictly limiting network access to the Forms Services listener to trusted sources, enforcing least privilege and monitoring privileged account activity, segmenting the deployment from other critical systems, and enabling comprehensive logging and alerting for anomalous behavior.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB