EUVD-2026-79435
GHSA-jwfg-xhgp-2q69
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network HTTP vector with low complexity but 'high privileged attacker' forces PR:H; scope change to other products yields S:C, and description confirms full C/I/A takeover.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Forms. While the vulnerability is in Oracle Forms, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Forms. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
AnalysisAI
High-privileged attackers who already hold administrative access within Oracle Fusion Middleware and can reach Oracle Forms over HTTP can achieve full takeover of the Forms service, with impact extending into other connected products. The flaw affects the Forms Services / Client-Server (C/S) Charmode component in Oracle Forms 12.2.1.19.0 and 14.1.2.0.0, and carries a CVSS 3.1 base score of 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) with high confidentiality, integrity and availability impact and a scope change - but the PR:H metric is decisive: this is not an unauthenticated remote exploit, no user interaction is needed, and the attacker must already be highly privileged before the attack begins. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the Oracle Forms 'Forms Services' component running in Client/Server (C/S) Charmode on affected versions 12.2.1.19.0 or 14.1.2.0.0, reachable over the network via HTTP. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, 9.1) describes a network-reachable, low-complexity flaw that nonetheless requires HIGH privileges (PR:H) - the description explicitly calls it a 'high privileged attacker' issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle patch associated with the vendor security alert for this CVE (https://www.oracle.com/security-alerts/cspusep2026.html) on Oracle Forms 12.2.1.19.0 and 14.1.2.0.0; no exact fix version number is provided in the available data, so confirm the patched release level directly from that advisory before scheduling the upgrade - patch status is 'no vendor-released patch version identified in the available data' rather than an absence of a fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances of Oracle Forms 12.2.1.19.0 and 14.1.2.0.0, restrict network access to Forms HTTP endpoints to trusted administrative networks only, and audit administrative accounts for unnecessary privileges. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today