Oracle Forms EUVD-2026-79433

Affects Oracle Forms Services in Client/Server, Character mode (C/S, Charmode) deployment on versions 12.2.1.19.0 and 14.1.2.0.0, reachable over HTTP. Exploitation is unauthenticated (PR:N) with no user interaction (UI:N), but is rated Difficult (AC:H) - meaning success depends on a condition outside the attacker's direct control (e.g., a race, specific server-side state, or a non-deterministic trigger) rather than a single deterministic request, which limits reliability and mass exploitation. The primary risk multiplier is the scope change (S:C): a successful attack can significantly impact products beyond Oracle Forms itself. Realistic exposure is limited to environments running the affected Forms Services C/S Charmode component with its HTTP interface reachable by the attacker.

This is a genuinely high-severity issue but with an important real-world limiter. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, 9.0) describes an unauthenticated (PR:N) network attack over HTTP that yields full compromise (C:H/I:H/A:H) with a scope change (S:C) affecting additional products beyond Oracle Forms. The AC:H metric - Oracle's phrasing 'Difficult to exploit' - is the key discriminator versus the AC:L Forms sibling CVE-2026-83094 (9.8): success likely requires winning a race, specific runtime state, or overcoming a non-deterministic condition, which reduces reliability and mass-exploitation potential. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so there is no evidence of active exploitation or automatable weaponization - this is a patch-priority-by-severity item, not a confirmed-in-the-wild emergency. Oracle's Critical Patch Update advisories are historically detail-free (no CWE, no root-cause, no affected-endpoint specifics), so the technical basis cannot be independently verified. Signals are internally consistent (pre-auth + full-triad + scope-change justify a 9.0 even with AC:H), so there is no CVSS/description contradiction to flag - the main caveat is simply the absence of exploitation telemetry.

An unauthenticated attacker with network reach to an exposed Oracle Forms Services (C/S, Charmode) HTTP endpoint sends a crafted request that, under the right conditions, triggers the flaw and achieves takeover of the Forms service. Because of the scope change, the attacker can then pivot to impact additional co-located products (e.g., the underlying middleware/WebLogic stack or backend resources). No public exploit code is identified at time of analysis, and the AC:H rating means the attack is not trivially reliable and may require repeated attempts or specific server state.