CVE-2026-83099 in Forms
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. While the vulnerability is in Oracle Forms, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Forms. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Oracle Forms component of Oracle Fusion Middleware, specifically affecting versions 12.2.1.19.0 and 14.1.2.0.0 under the Forms Services configuration involving Client/Server architecture and Charmode settings. This flaw represents a critical security deficiency that permits unauthenticated attackers to achieve complete system compromise through network access via HTTP. The severity of this issue is underscored by its CVSS v3.1 base score of 10.0, indicating it is the highest possible level of risk. The vector string (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) confirms that the attack requires no user interaction or authentication, has low complexity, and critically exhibits a scope change where the impact extends beyond the vulnerable component to compromise additional products within the environment.
From a technical perspective, this vulnerability allows for remote code execution leading to full takeover of the Oracle Forms application server. The absence of required authentication means that any entity with network connectivity to the affected HTTP endpoint can exploit the flaw without credentials. This aligns closely with CWE-287, which describes Improper Authentication, and potentially CWE-94, Code Injection, depending on the specific mechanism used to achieve code execution within the Forms Services layer. The ability of an attacker to take over Oracle Forms suggests a failure in input validation or access control mechanisms that should restrict untrusted network traffic from executing privileged operations.
The operational impact of this vulnerability is severe and multifaceted due to the scope change characteristic noted in the CVSS vector. While the direct target is Oracle Forms, the compromise can cascade into other integrated products within the Fusion Middleware ecosystem. This lateral movement capability means that an attacker gaining control over Oracle Forms could potentially access sensitive data stored in associated databases, manipulate application logic across multiple services, or use the compromised server as a pivot point for further attacks against internal network resources. The high impact on confidentiality, integrity, and availability indicates that attackers can exfiltrate proprietary information, alter critical business processes, and disrupt service delivery to end-users simultaneously.
Mitigation strategies must prioritize immediate isolation of affected systems from untrusted networks until patches are applied. Organizations should verify their inventory for the specified vulnerable versions 12.2.1.19.0 and 14.1.2.0.0 and apply the latest security updates provided by Oracle as soon as they become available in a production-ready state. In the interim, network segmentation is crucial to restrict HTTP access to these services exclusively from trusted internal subnets or specific management IPs. Additionally, implementing strict firewall rules to block direct external internet access to ports associated with Oracle Forms can significantly reduce the attack surface. Security teams should also monitor for signs of unauthorized access attempts and ensure that logging mechanisms are enabled to detect exploitation activities consistent with ATT&CK techniques such as T1059 Command and Scripting Interpreter or T1078 Valid Accounts if privilege escalation occurs post-exploitation.