CVE-2026-83093 in Forms
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. While the vulnerability is in Oracle Forms, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Forms accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Oracle Forms product, specifically affecting the Forms Services component in client/server and Charmode configurations of Oracle Fusion Middleware. This security flaw impacts supported software versions 12.2.1.19.0 and 14.1.2.0.0, representing a significant risk to organizations relying on these legacy or current enterprise application development frameworks for building web-based business applications. The core issue stems from an easily exploitable vulnerability that permits unauthenticated attackers with network access via the HTTP protocol to compromise the integrity of the Oracle Forms environment. This lack of authentication requirement is particularly dangerous as it allows remote adversaries to initiate attacks without needing valid credentials, thereby lowering the barrier to entry for malicious actors targeting these systems.
The operational impact of this vulnerability extends beyond the immediate scope of the Oracle Forms application itself due to a phenomenon known as scope change in attack vectors. While the technical flaw is located within Oracle Forms, successful exploitation can lead to significant lateral movement and compromise of additional products connected to or integrated with the middleware infrastructure. This cascading effect means that an attacker gaining unauthorized access through this vector could potentially pivot to other critical systems within the enterprise network, amplifying the overall risk profile far beyond a single application failure. The primary consequence highlighted by the vulnerability assessment is a high impact on confidentiality, allowing for unauthorized access to critical data or complete access to all Oracle Forms accessible data. This level of data exposure can result in severe business disruption, regulatory non-compliance, and loss of intellectual property depending on the nature of the stored information.
From a technical classification perspective, this vulnerability aligns with CWE-287, which describes Improper Authentication, as it allows an unauthenticated actor to perform actions that should require verification of identity. Furthermore, given the network-based exploitation via HTTP and the potential for data exfiltration or unauthorized access, the attack pattern correlates with ATT&CK techniques related to Initial Access such as T1190 Exploit Public-Facing Application and potentially T1530 Data from Local System Extraction if the attacker gains sufficient privileges to read files. The CVSS 3.1 base score of 8.6 reflects a High severity rating, driven by the network accessibility, low complexity, lack of required user interaction or authentication, and high confidentiality impact despite no immediate integrity or availability loss being explicitly detailed in the vector string.
Mitigation strategies must prioritize immediate remediation through patching to the latest available version that addresses this specific flaw within Oracle Fusion Middleware. Organizations should also implement strict network segmentation to isolate Oracle Forms servers from untrusted networks, ensuring they are only accessible via secure and authenticated channels where possible. Web Application Firewalls can be configured to detect and block anomalous HTTP requests associated with exploitation attempts of this vulnerability. Additionally, reviewing access controls and implementing multi-factor authentication for any remaining administrative interfaces can reduce the attack surface. Continuous monitoring for unusual data access patterns or unauthorized connection attempts from external IP addresses is essential to detect potential exploitation in real-time before significant damage occurs.