EUVD-2026-79422
GHSA-h66h-jh9v-5j69
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Oracle Forms HTTP endpoint
-
DeliverySend crafted unauthenticated HTTP request
-
ExploitBypass authentication in Forms Services
-
ExecutionGain full control of Forms instance
-
ImpactExfiltrate data and disrupt operations
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to an Oracle Forms deployment exposing the Forms Services (C/S, Charmode) component over HTTP; affected versions are Oracle Forms 12.2.1.19.0 and 14.1.2.0.0. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no non-default configuration are stated as prerequisites, so default network-reachable Forms Services instances of the affected versions are exploitable. The primary limiting factor is exposure: Forms Services is often deployed behind internal networks, reverse proxies, or VPNs rather than directly internet-facing, which materially reduces the reachable attack surface in many enterprise deployments. |
| Impact | This is a genuine high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) describes remote, network-based, unauthenticated (PR:N) exploitation with low complexity and no user interaction, yielding full confidentiality, integrity, and availability compromise ('takeover of Oracle Forms'). Oracle itself labels the flaw 'easily exploitable,' which aligns with AC:L. The 9.8 score is well-calibrated for a genuine pre-auth full-triad takeover; scope is Unchanged (S:U), so it does not reach the 9.9/10.0 of scope-change siblings in the same CPU. Countervailing signals temper the raw score: no CISA KEV listing, no public proof-of-concept, and no EPSS probability were provided, so there is no evidence of active or imminent widespread exploitation at time of analysis. As is typical for Oracle Critical Patch Update entries, the advisory (cspusep2026) contains zero technical detail, which both slows reliable exploit development and limits independent verification. Net: patch on priority given the pre-auth RCE-class impact and easy exploitability, but current exploitation evidence is absent rather than confirmed. |
| Exploit ScenarioDerived | An unauthenticated attacker with network reachability to an exposed Oracle Forms Services endpoint sends a crafted HTTP request that abuses the Forms Services (C/S, Charmode) component to bypass authentication and gain control, resulting in complete takeover of the Oracle Forms instance. No credentials, user interaction, or special client is required (AV:N/AC:L/PR:N/UI:N). No public proof-of-concept was identified in the provided data, and Oracle's advisory withholds technical detail. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Authentication bypass in Oracle Forms (Oracle Fusion Middleware) 12.2.1.19.0 and 14.1.2.0.0 lets an unauthenticated, network-positioned attacker take over the Forms Services component - including its C/S and Charmode channels - over HTTP. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or non-default configuration are stated prerequisites, and the impact is rated complete loss of confidentiality, integrity, and availability (CVSS 3.1 base 9.8). No CISA KEV entry or public exploit code was identified at time of analysis (EPSS was not provided in the available data); the practical limiting factor is exposure, since Forms Services is frequently shielded behind internal networks, reverse proxies, or VPNs rather than being internet-facing. Our assessment concurs with the vendor vector and classifies this as a genuine high-priority vulnerability.
RemediationAI
Apply the fixes published in Oracle's security advisory for CVE-2026-83094 (https://www.oracle.com/security-alerts/cspusep2026.html), upgrading Oracle Forms on Fusion Middleware 12.2.1.19.0 and 14.1.2.0.0 to the patched release level specified in that advisory - patch availability is confirmed per the vendor advisory, while the exact patched version string should be read directly from the Oracle alert rather than assumed. Oracle patch updates for Fusion Middleware are cumulative, so apply the full CPU rather than cherry-picking a single component, and restart the Forms Services managed servers so the new binaries are loaded. If patching cannot be completed immediately, the most effective compensating control is to remove untrusted reachability: restrict the Forms Services HTTP listener with network ACLs, firewall rules, or a reverse proxy that allowlists only known client subnets, or require VPN access for all Forms users - the trade-off is that legitimate remote and external users will need the VPN or an updated allowlist, and any ad-hoc exceptions reopen the exposure. Additional hardening includes disabling or blocking the Charmode/C/S endpoints entirely where only browser-based Forms is in use, and adding logging and alerting on unauthenticated requests to the Forms Services endpoints so that exploitation attempts that fail authentication are still detected. Confirm that the ENISA EUVD entry (EUVD-2026-79422) and the Oracle advisory match your deployed build before closing the finding, and re-check for an updated Oracle alert in case the vendor revises the guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Forms is Oracle Fusion Middleware's rapid application development environment for building database-centric, data-entry/CRUD applications; the affected component set spans Forms Services (the Java-based middle tier that serves and runs forms), the C/S (client/server) connectivity path, and Charmode (character-mode) sessions. These channels communicate over HTTP, which is why the vulnerability is scored AV:N. The assigned weakness class is CWE-287 (Improper Authentication), meaning the product fails to correctly verify or enforce a caller's identity before granting access - the root cause class is a failure of the authentication control itself rather than a memory-safety or input-validation defect. Because the issue is reachable pre-authentication (PR:N) with no user interaction (UI:N) and low attack complexity (AC:L), the exposure decision (whether the Forms listener is reachable by untrusted networks) is the dominant risk variable. CPE identifiers were not furnished in the source data; affected scope is defined by the vendor advisory's version list and the ENISA EUVD record (EUVD-2026-79422).
Know when Forms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle describes easily exploitable unauthenticated HTTP compromise resulting in full takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H and unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. Successful attacks of this vulnerability can result in takeover of Oracle Forms. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
A critical authentication bypass in Oracle Forms (Oracle Fusion Middleware 12.2.1.19.0 and 14.1.2.0.0) allows an unauthenticated attacker with network access to seize control of the Forms Services component, the runtime layer behind many Oracle E-Business Suite and custom Forms-based business applications. Because no vendor patch exists and the flaw yields complete loss of confidentiality, integrity, and availability on the affected service, every organization exposing Forms Services - even only to internal networks, VPN users, or partner connections - carries unmitigated risk to a platform that typically fronts financially and operationally significant workflows. Leadership should treat this as a time-bound exposure-management problem: the vulnerability is not yet observed to be exploited, so the practical priority is reducing reachability before exploit activity or tooling appears.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network reachability of Forms Services to trusted segments only (deny by default at perimeter and host firewalls); terminate all access behind an authenticated reverse proxy, VPN, or zero-trust gateway requiring MFA; disable or firewall the C/S and Charmode channels where not operationally required; segment affected instances and remove unnecessary outbound connectivity; enable verbose audit logging and alerting on anomalous HTTP access to Forms Services; consult Oracle support for interim fixes and mitigation guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated remote takeover of Oracle Forms is possible in the Forms Services (C/S, Charmode) component of Oracle Fu
Stored cross-site scripting in the Forms WordPress plugin (versions before 3.0.2) allows an unauthenticated attacker to
Unauthenticated remote takeover of Oracle Forms is achievable through the Forms Services C/S Charmode component in versi
Unauthenticated remote attackers with HTTP reachability to the Oracle Forms Services listener can bypass authentication
Unrestricted network access to Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 allows unauthenticated attackers to bypass authen
Full takeover of Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 is achievable by an unauthenticated remote attacker exploiting
Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a r
Unauthenticated remote code execution in the Balbooa Forms extension for Joomla (versions before 2.4.3.4) lets a visitor
The Forms WordPress plugin before 1.12.3 did not sanitise its input fields, leading to Stored Cross-Site scripting issue
Improper authentication in the Oracle Forms Client/Server (C/S) Charmode runtime allows an unauthenticated, network-reac
Unauthenticated path traversal in Balbooa Forms (a Joomla extension) before 2.4.3.4 allows remote attackers to exfiltrat
Authentication bypass in Oracle Forms (component: Forms Services, C/S, Charmode) allows an unauthenticated remote attack
Exploit-DB