EUVD-2026-79435
GHSA-jwfg-xhgp-2q69
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privilege Forms access
-
DeliverySend crafted HTTP request to Forms Services
-
ExploitExploit Charmode C/S flaw
-
ExecutionTake over Oracle Forms
-
ImpactPivot to impact adjacent products (scope change)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the Oracle Forms 'Forms Services' component running in Client/Server (C/S) Charmode on affected versions 12.2.1.19.0 or 14.1.2.0.0, reachable over the network via HTTP. The decisive limiting factor is PR:H: the attacker must already possess HIGH privileges within Oracle Forms/Fusion Middleware - this is NOT remotely exploitable by an unauthenticated actor. The scope change (S:C) means a successful attack can extend beyond Forms to additional connected products, but only after the high-privilege precondition is met. No user interaction is required (UI:N). |
| Impact | The vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, 9.1) describes a network-reachable, low-complexity flaw that nonetheless requires HIGH privileges (PR:H) - the description explicitly calls it a 'high privileged attacker' issue. This is the single most important risk limiter: unlike the genuinely pre-auth Oracle Forms siblings (CVE-2026-83094 at 9.8 and CVE-2026-83104 at 9.1, both PR:N), CVE-2026-83107 cannot be triggered by an anonymous attacker - it presupposes an actor who already holds elevated Forms/middleware privileges. The 9.1 score is driven almost entirely by the scope change (S:C) and full C:H/I:H/A:H triad, not by ease of initial access. On exploitation signals: no EPSS score is provided, the CVE is NOT on CISA KEV, and no public POC is referenced - so this is 'no public exploit identified at time of analysis.' Oracle's September 2026 Critical Patch Update (cspusep2026) provides zero technical detail, which is standard for Oracle CPUs and means affected-version and impact data cannot be independently corroborated. Net assessment: despite the 9.1 'Critical'-adjacent score, real-world priority is materially lower than the pre-auth twins because the PR:H prerequisite converts this into a privilege-escalation / lateral-impact issue for an already-authenticated high-privilege user rather than an internet-facing pre-auth takeover. Patch during the normal CPU cycle, prioritizing internet-exposed Forms Services instances behind weaker access controls. |
| Exploit ScenarioDerived | An attacker who has already obtained high-privilege access to an Oracle Forms Services (C/S, Charmode) deployment sends crafted HTTP requests to the Forms service, exploiting the flaw to achieve full takeover of Oracle Forms and, via the scope change, to significantly impact additional connected middleware products. No public exploit code or active exploitation has been identified, and success is gated on the attacker first holding elevated privileges (PR:H). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
High-privileged attackers who already hold administrative access within Oracle Fusion Middleware and can reach Oracle Forms over HTTP can achieve full takeover of the Forms service, with impact extending into other connected products. The flaw affects the Forms Services / Client-Server (C/S) Charmode component in Oracle Forms 12.2.1.19.0 and 14.1.2.0.0, and carries a CVSS 3.1 base score of 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) with high confidentiality, integrity and availability impact and a scope change - but the PR:H metric is decisive: this is not an unauthenticated remote exploit, no user interaction is needed, and the attacker must already be highly privileged before the attack begins. No public exploit code and no CISA KEV entry were identified from the available intelligence sources at the time of analysis, and no EPSS score was supplied in the source data.
RemediationAI
Apply the Oracle patch associated with the vendor security alert for this CVE (https://www.oracle.com/security-alerts/cspusep2026.html) on Oracle Forms 12.2.1.19.0 and 14.1.2.0.0; no exact fix version number is provided in the available data, so confirm the patched release level directly from that advisory before scheduling the upgrade - patch status is 'no vendor-released patch version identified in the available data' rather than an absence of a fix. Because exploitation requires high privileges (PR:H), the highest-value compensating controls are privilege-side: aggressively minimize and audit Forms/Fusion Middleware accounts holding administrative privileges, enforce least privilege and separation of duties, and rotate or disable dormant high-privilege accounts, accepting the operational cost of tighter admin access reviews and the risk of workflow friction for Forms administrators. In parallel, restrict network reachability to the Forms Services HTTP endpoints (especially C/S and Charmode listeners) to trusted administrative networks or jump hosts via firewall/allow-list rules; the trade-off is reduced administrative convenience and possible breakage of legitimate remote clients. Where Charmode or Client/Server mode is not actively required, disable those listener modes and run only the modern HTTP/Forms Services deployment path, accepting that legacy clients will stop working. Monitor HTTP access logs and Forms/Fusion Middleware audit trails for high-privilege actions against Forms endpoints as a detection layer, understanding this is detective rather than preventive. This vulnerability is not confirmed as actively exploited via CISA KEV and no public exploit code was identified, so remediation can follow standard critical patch-cycle urgency, but the 9.1 severity and scope change justify prioritizing it ahead of routine lower-severity items.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Forms is a long-standing application-development and runtime platform within Oracle Fusion Middleware; the affected component is Forms Services together with its Client/Server and Charmode (character-mode) execution paths, which are typically delivered over HTTP through Oracle HTTP Server or WebLogic and connect to an Oracle database. The client/server and Charmode modes are legacy but still deployed in many enterprise Forms estates, which is why Oracle continues to ship these versions (12.2.1.19.0 and 14.1.2.0.0). No CWE mapping was provided in the source data, so the precise root-cause class is not officially classified; however, the vector profile - network reachable, low attack complexity, PR:H, and scope change (S:C) - is consistent with a privilege-boundary or insufficient authorization/validation defect that lets an already-trusted, high-privilege operator step outside the intended confines of the Forms component and affect additional connected products. Note a tagging inconsistency worth flagging: the source tags label this as 'Information Disclosure', yet the assessed vector indicates complete loss of confidentiality, integrity and availability, so the tag should not be relied upon to down-scope the impact. The Oracle security alert reference (cspusep2026.html) is the authoritative vendor advisory, and the EUVD entry (EUVD-2026-79435) independently lists the same two affected versions.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network HTTP vector with low complexity but 'high privileged attacker' forces PR:H; scope change to other products yields S:C, and description confirms full C/I/A takeover.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Forms. While the vulnerability is in Oracle Forms, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Forms. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Executive ViewAI
Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain a critical vulnerability that could allow an attacker with existing administrative access to fully compromise the Forms service and potentially pivot to connected enterprise applications. While exploitation requires prior high-level privileges, a successful attack could lead to unauthorized access to sensitive data, operational disruption, and extensive damage across integrated systems, making it a priority for organizations relying on these Oracle Fusion Middleware components.
Restrict network access to Oracle Forms HTTP endpoints, enforce strict least privilege for administrative accounts, enable detailed logging and monitoring for anomalous activity, and consider temporary removal of non-essential administrative access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB