Oracle Forms EUVD-2026-79430

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) describes an unauthenticated, remotely reachable flaw whose confidentiality and integrity impact is complete for the Forms application's data, with no availability impact - a strong combination, tempered significantly by AC:H, which tells defenders the attacker must satisfy a non-trivial precondition. That is precisely the profile that gets over-prioritized on raw score alone: 7.4 is HIGH, but a high-complexity, condition-dependent bug is materially harder to industrialize than a 9.8 network drop. There is no EPSS score, no CISA KEV entry, and no POC signal in this dataset, so the honest read is "theoretical-to-conditional exploitation risk, not an emergency," pending Oracle's or the research community's disclosure of the trigger condition. There is also no availability impact and no scope change, so blast radius is confined to the Forms application rather than the host or the database layer - though in practice Forms sits directly in front of high-value business data, which raises the value of the target. Even so, a mid-sized municipal IT team in gliwice running Forms screens for citizen-facing services should treat this as urgent patching on the normal CPU cadence rather than a same-hour incident, because the exploitable precondition is not publicly known, but unauthenticated reachability plus write access to business records is not a risk to sit on. Note a data gap: the absence of EPSS and KEV data in the input means the exploitation-likelihood picture is incomplete and should be re-checked against live feeds before final prioritization.

An attacker who can reach the Oracle Forms HTTP listener - for example from an internet-exposed or partner-reachable middle tier - sends specially crafted requests to the Forms Services endpoint and waits for or induces the state in which authentication and authorization checks fail, gaining read and write access to application data. Because the vendor rates the attack complexity as high, the attacker likely needs to probe the target repeatedly to find the right timing or server state, making the exploit opportunistic rather than a single-shot payload. No public exploit code has been observed, so this remains a condition-dependent attack rather than a turnkey tool at time of analysis.