EUVD-2026-79430
GHSA-gwp8-3849-8p96
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable and unauthenticated per vendor, but AC:H reflects an undisclosed condition and no availability impact applies.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Forms accessible data as well as unauthorized access to critical data or complete access to all Oracle Forms accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
AnalysisAI
Unauthenticated network attackers can reach Oracle Forms Services (including the C/S and Charmode components) over HTTP and achieve unauthorized access to, or modification and deletion of, critical data held in the application, in Oracle Forms 12.2.1.19.0 and 14.1.2.0.0. Oracle rates the issue 7.4 with high confidentiality and integrity impact but explicitly characterizes it as difficult to exploit (AC:H), meaning a favorable timing or state condition is required rather than simple request replay. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) describes an unauthenticated, remotely reachable flaw whose confidentiality and integrity impact is complete for the Forms application's data, with no availability impact - a strong combination, tempered significantly by AC:H, which tells defenders the attacker must satisfy a non-trivial precondition. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle fixes published in the advisory at https://www.oracle.com/security-alerts/cspusep2026.html for the affected Oracle Forms releases 12.2.1.19.0 and 14.1.2.0.0 - Oracle Critical Patch Update guidance typically requires either the CPU-provided patch for that release line or an upgrade to a newer supported Forms version, and administrators should confirm the exact build number in the advisory rather than assuming a generic update covers it; the input data does not state a specific fixed version string, so verify before declaring remediation complete. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today