Oracle Life Sciences Inform
Monthly
Unauthenticated network exploitation of the Oracle Life Sciences InForm App Server (versions 7.0.1.0 and 7.0.1.1) allows remote attackers to read a subset of clinical trial application data and perform unauthorized insert, update, or delete operations via HTTP - with no credentials or user interaction required. Rooted in CWE-284 (Improper Access Control) and tagged as an Authentication Bypass, the App Server fails to enforce access controls on certain endpoints, confirmed by Oracle in the April 2026 Critical Patch Update. No public exploit code or active exploitation has been identified; EPSS sits at 0.03% (8th percentile), though SSVC flags the attack as automatable.
Improper access control in the IDM Authentication component of Oracle Life Sciences InForm 7.0.1.0 and 7.0.1.1 exposes the platform to unauthenticated network-based attacks over HTTP that require victim user interaction to succeed. Successful exploitation yields unauthorized partial read, write/delete, and denial-of-service impact against InForm clinical trial data. No public exploit code exists and no active exploitation has been identified; EPSS at 0.03% (9th percentile) and SSVC exploitation status of 'none' confirm minimal real-world threat at this time.
Unauthenticated network exploitation of the Oracle Life Sciences InForm App Server (versions 7.0.1.0 and 7.0.1.1) allows remote attackers to read a subset of clinical trial application data and perform unauthorized insert, update, or delete operations via HTTP - with no credentials or user interaction required. Rooted in CWE-284 (Improper Access Control) and tagged as an Authentication Bypass, the App Server fails to enforce access controls on certain endpoints, confirmed by Oracle in the April 2026 Critical Patch Update. No public exploit code or active exploitation has been identified; EPSS sits at 0.03% (8th percentile), though SSVC flags the attack as automatable.
Improper access control in the IDM Authentication component of Oracle Life Sciences InForm 7.0.1.0 and 7.0.1.1 exposes the platform to unauthenticated network-based attacks over HTTP that require victim user interaction to succeed. Successful exploitation yields unauthorized partial read, write/delete, and denial-of-service impact against InForm clinical trial data. No public exploit code exists and no active exploitation has been identified; EPSS at 0.03% (9th percentile) and SSVC exploitation status of 'none' confirm minimal real-world threat at this time.