CVE-2026-83109 in Forms
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Forms accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Oracle Forms product, specifically affecting the Forms Services component in client/server mode with Charmode enabled for supported versions 12.2.1.19.0 and 14.1.2.0.0 of Oracle Fusion Middleware. This security flaw permits an unauthenticated attacker to compromise the integrity of the application by leveraging network access via HTTP. The vulnerability is characterized as easily exploitable, requiring no user interaction or prior authentication credentials, which significantly lowers the barrier for entry for malicious actors targeting these specific middleware configurations.
From a technical perspective, the core issue involves improper handling of requests that leads to unauthorized data exposure. While the initial vector suggests broad access capabilities, the actual operational impact is constrained primarily to confidentiality breaches rather than integrity or availability disruptions. Successful exploitation allows an attacker to read a subset of Oracle Forms accessible data without authorization. This indicates a flaw in the access control mechanisms governing how form sessions and their associated data are served over HTTP connections when Charmode is active. The lack of authentication requirement means that any entity with network connectivity to the vulnerable service can attempt this exploit, making it particularly dangerous in environments where internal networks may not be strictly segmented or firewalled against all external traffic.
The operational impact centers on information disclosure, which aligns directly with CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. By gaining unauthorized read access to a subset of data, attackers can potentially extract sensitive business logic, user details, financial records, or other proprietary information embedded within the forms. Although the CVSS 3.1 base score is rated at 5.3 with only confidentiality impacts, this level of exposure can still lead to significant downstream risks such as social engineering attacks, further reconnaissance for more severe exploits like SQL injection or remote code execution by understanding the data structure and application behavior. The attack vector falls under ATT&CK technique T1078: Valid Accounts if credentials were required, but since it is unauthenticated, it aligns more closely with initial access techniques that exploit misconfigured services or default settings, potentially mapping to TA0001 Initial Access in the MITRE ATT&CK framework.
Mitigation strategies must focus on immediate remediation and network-level controls. Oracle should be consulted for the latest security patches addressing this specific vulnerability in Forms Services Charmode. Administrators running affected versions 12.2.1.19.0 or 14.1.2.0.0 are advised to apply these updates as soon as they become available from official support channels. In the interim, if patching is not immediately feasible, network segmentation should be enforced to restrict HTTP access to the Oracle Forms service only from trusted IP ranges. Additionally, implementing a Web Application Firewall can help filter out malicious requests that attempt to exploit this flaw by inspecting incoming traffic for patterns associated with unauthorized data retrieval attempts. Enforcing strict authentication policies and disabling Charmode if it is not strictly required for business operations may also reduce the attack surface significantly.