CVE-2026-83096 in Forms
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Forms. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Forms, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Forms accessible data as well as unauthorized access to critical data or complete access to all Oracle Forms accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Forms. CVSS 3.1 Base Score 7.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Oracle Forms product of Oracle Fusion Middleware, specifically affecting the Forms Services component in client/server and Charmode configurations. This security flaw impacts specific supported versions including 12.2.1.19.0 and 14.1.2.0.0. The nature of this defect is characterized by a complex exploitation vector that requires significant conditions to be met before an attacker can successfully compromise the system. While the vulnerability allows for remote code execution or data manipulation via HTTP, it is classified as difficult to exploit due to high complexity requirements and specific prerequisite states within the application logic. This classification aligns with CWE-20 Improper Input Validation, where the software fails to adequately sanitize or verify user-supplied input before processing, leading to unintended behavior that can be leveraged for malicious purposes.
The attack vector is network-based, allowing a low privileged attacker who has access via HTTP to initiate the exploitation process. However, the vulnerability does not allow for fully automated remote code execution without additional steps. A critical requirement for successful exploitation is human interaction from a person other than the attacker. This social engineering aspect suggests that the exploit likely involves tricking an authenticated user into performing a specific action or clicking on a malicious link within the Oracle Forms interface. This characteristic maps directly to ATT&CK technique T1566 Phishing, where attackers rely on deceiving users into interacting with compromised content. The presence of this human interaction requirement significantly raises the barrier for entry compared to fully automated remote exploits, yet it remains dangerous in environments where user awareness is low or social engineering tactics are prevalent.
The operational impact of a successful exploitation is severe and multifaceted, affecting confidentiality, integrity, and availability as reflected by the CVSS 3.1 Base Score of 7.9. Upon compromise, an attacker gains unauthorized ability to create, delete, or modify critical data within Oracle Forms. This represents a significant breach of data integrity, allowing for CWE-264 Permissions, Privileges, and Access Controls violations where the attacker bypasses intended restrictions to alter system state. Furthermore, the vulnerability enables unauthorized access to critical data, potentially leading to complete exposure of all accessible information stored or processed by Oracle Forms. This aligns with CWE-200 Exposure of Sensitive Information to an Unauthorized Actor, posing substantial risks for organizations handling sensitive corporate or personal data.
In addition to data compromise, the vulnerability impacts system availability through a partial denial of service condition. Successful attacks can cause Oracle Forms services to become partially unresponsive or degraded, disrupting business operations that rely on these web-based applications. This aspect corresponds to CWE-400 Uncontrolled Resource Consumption, where malicious inputs trigger resource exhaustion or logic errors that impair normal functionality. The scope change noted in the vulnerability description indicates that while the flaw is located within Oracle Forms, the consequences can ripple out to impact additional products integrated with it. This highlights the interconnected nature of enterprise middleware ecosystems and underscores how a weakness in one component can destabilize broader organizational infrastructure.
Mitigation strategies must address both technical controls and procedural safeguards due to the complex exploitation requirements. Organizations should immediately apply available patches or updates provided by Oracle for versions 12.2.1.19.0 and 14.1.2.0.0, as these typically contain fixes that enforce stricter input validation and access control checks within Forms Services. Implementing network-level protections such as Web Application Firewalls can help detect and block malicious HTTP requests associated with the exploitation attempt before they reach the application layer. Additionally, since human interaction is required for successful attacks, enhancing user training programs to recognize phishing attempts and suspicious links within Oracle Forms interfaces is crucial. Restricting access to Oracle Forms services based on least privilege principles ensures that even if an account is compromised, the attacker's ability to cause widespread damage or exfiltrate data remains limited until further lateral movement occurs.