EUVD-2026-79432
GHSA-5xmg-cqp6-52jv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Forms Services over TCP
-
ExploitSend crafted request bypassing authentication
-
ExecutionGain unauthenticated access to Forms
-
ImpactRead and modify all accessible data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to an Oracle Forms Services deployment running in Client/Server (C/S) Charmode on affected versions 12.2.1.19.0 or 14.1.2.0.0, exploitable over TCP. No special conditions beyond that - remote unauthenticated exploitation (PR:N/UI:N/AC:L) is possible with no credentials and no user interaction. Limiting factors: the vulnerable component is the specific C/S Charmode Forms Services runtime (a legacy client/server presentation mode, not every Forms web deployment), and impact is confined to data confidentiality and integrity with no availability effect; exposure depends on the Forms Services listener being network-reachable to the attacker. |
| Impact | This is a genuine high-priority pre-authentication flaw, though not a maximal-severity one. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation over the network with no user interaction - the CWE-287 (Improper Authentication) classification and the 'Authentication Bypass' tag both corroborate a true pre-auth condition. Impact is scoped to confidentiality and integrity only (C:H/I:H/A:N): an attacker can read and tamper with all Oracle Forms accessible data but cannot degrade availability, which is why the score is 9.1 rather than the 9.8 of the availability-affecting same-product sibling CVE-2026-83094. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active or automated exploitation yet; the risk is currently potential rather than observed. The Oracle CPU advisory (cspusep2026) provides zero technical detail, which is typical for Oracle and limits independent verification of the root cause. Net: treat as a real remote data-compromise priority for exposed Forms deployments, but note exploitation status is unproven and the affected product footprint is legacy/enterprise rather than internet-ubiquitous. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach an exposed Oracle Forms Services (C/S, Charmode) endpoint over TCP sends crafted traffic that bypasses authentication and gains read/write access to all Forms-accessible data. No public exploit code is identified at time of analysis, and no user interaction or credentials are required, so a network-reachable instance is directly at risk. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Improper authentication in the Oracle Forms Client/Server (C/S) Charmode runtime allows an unauthenticated, network-reachable attacker to bypass authentication and operate with the data privileges granted to the Oracle Forms application, yielding high confidentiality and integrity impact (CVSS 3.1 base 9.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Oracle Forms 12.2.1.19.0 and 14.1.2.0.0, as shipped in Oracle Fusion Middleware (Forms Services, C/S, Charmode), are affected; the vector requires no credentials and no user interaction, and there is no availability impact. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and exposure is limited to deployments whose C/S Charmode listener is network-reachable over TCP from an untrusted network.
RemediationAI
Apply the fix from Oracle's Critical Security Patch Update referenced for this CVE (https://www.oracle.com/security-alerts/cspusep2026.html), which is the authoritative source for the patched builds of Oracle Forms 12.2.1.19.0 and 14.1.2.0.0; the specific patched build numbers are not enumerated in the available data, so confirm the exact patched release in that advisory before closing the finding. If patching cannot be completed promptly, the most effective compensating control is network restriction: block TCP access to the Forms Services C/S Charmode listener from untrusted networks using firewall rules, network segmentation, or a VPN/allow-listed jump host, accepting that this breaks remote client/server access for legitimate Charmode users who connect from outside the trusted zone. Where Charmode is no longer required, shut the Charmode listener down entirely and move users to the web-deployed Forms presentation mode, with the trade-off that any remaining legacy character-mode clients will stop working; simply disabling Charmode features or adding a presentation-layer lockout is not a substitute for the patch because the bypass occurs at authentication itself. Because exploitation requires only reachability and no credentials or user interaction, also enable connection logging and alerting on the Forms listener so anomalous or unusually numerous pre-authentication Charmode connections can be detected, bearing in mind that detection is a compensating measure only and does not prevent exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Forms is Oracle Fusion Middleware's rapid application development framework for building database-backed data-entry applications; Forms Services renders and executes those applications for clients, and the legacy Client/Server Charmode mode provides a character-mode client/server presentation path in which clients communicate with the Forms Services runtime over a TCP listener. The root cause is tracked as CWE-287 (Improper Authentication): the authentication step that should establish and verify the identity of a Charmode client can be bypassed, so a remote attacker who can open a TCP connection to the affected listener is treated as an authenticated Forms session and inherits that session's access to Forms-accessible data. Because CWE-287 failures occur before authorization is applied, the practical reach of the flaw is bounded by the privileges of the Forms application itself (typically backend database objects reachable by the Forms runtime), which tracks with the assessed impact of high confidentiality and high integrity but no availability effect (C:H/I:H/A:N). Notably, the flaw is scoped to the C/S Charmode presentation mode rather than to every Forms Services web deployment, which is a meaningful limiting factor on which systems are actually at risk. The affected CPE/version set identified by EUVD is Oracle Forms 14.1.2.0.0 and Oracle Forms 12.2.1.19.0, corresponding to the versions named by Oracle; note that no CPE strings were supplied in the source data beyond these version identifications, and no CWE-level root-cause detail beyond improper authentication was disclosed by the vendor.
Know when Forms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description states unauthenticated network TCP access with no interaction (AV:N/AC:L/PR:N/UI:N); impact is read and modify all Forms data with no availability loss, so C:H/I:H/A:N and S:U.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Forms. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Forms accessible data as well as unauthorized access to critical data or complete access to all Oracle Forms accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 deployments that expose the Client/Server Charmode listener to untrusted networks are exposed to an unauthenticated authentication bypass that can give an attacker the data privileges of the Forms application, and no vendor patch is currently available. Leadership should care because any external or cross-segment reachability of that listener allows an attacker to read and alter business data without credentials or user interaction, and there is no public exploit identified at time of analysis. Risk is concentrated in network-exposed Forms Services environments and must be managed through segmentation and monitoring until Oracle releases a fix.
No vendor patch available. Restrict network access to the Oracle Forms C/S Charmode listener through firewall, security group, or host-based rules; disable the Charmode listener where not required; enforce network segmentation so only trusted administrative segments can reach it; enable and monitor connection logging and alerting; and conduct threat hunting for anomalous application access or data modification until a vendor patch is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated remote takeover of Oracle Forms is possible in the Forms Services (C/S, Charmode) component of Oracle Fu
Stored cross-site scripting in the Forms WordPress plugin (versions before 3.0.2) allows an unauthenticated attacker to
Unauthenticated remote takeover of Oracle Forms is achievable through the Forms Services C/S Charmode component in versi
Unauthenticated remote attackers with HTTP reachability to the Oracle Forms Services listener can bypass authentication
Authentication bypass in Oracle Forms (Oracle Fusion Middleware) 12.2.1.19.0 and 14.1.2.0.0 lets an unauthenticated, net
Unrestricted network access to Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 allows unauthenticated attackers to bypass authen
Full takeover of Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 is achievable by an unauthenticated remote attacker exploiting
Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a r
Unauthenticated remote code execution in the Balbooa Forms extension for Joomla (versions before 2.4.3.4) lets a visitor
The Forms WordPress plugin before 1.12.3 did not sanitise its input fields, leading to Stored Cross-Site scripting issue
Unauthenticated path traversal in Balbooa Forms (a Joomla extension) before 2.4.3.4 allows remote attackers to exfiltrat
Authentication bypass in Oracle Forms (component: Forms Services, C/S, Charmode) allows an unauthenticated remote attack
Exploit-DB