CVE-2026-83094

CVE-2026-83094 is a critical vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) within Oracle Fusion Middleware, affecting versions 12.2.1.19.0 and 14.1.2.0.0. It is easily exploitable by an unauthenticated attacker with network access via HTTP, requiring no privileges or user interaction, and successful attacks result in complete takeover of Oracle Forms with high impact to confidentiality, integrity, and availability (CVSS 3.1: 9.8). Organizations running the affected Forms versions as part of on-premises middleware stacks or business applications built on Forms are at risk, particularly if Forms Services endpoints are reachable from untrusted networks. No public proof of concept is known and the flaw is not on the CISA KEV list, but the combination of no authentication and full compromise makes patching urgent. Oracle addressed this via its Critical Patch Update process.

What to do: Apply the Oracle Critical Patch Update that remediates this issue for Forms 12.2.1.19.0 and 14.1.2.0.0 as soon as possible. Verify whether Forms Services (C/S, Charmode) endpoints are exposed to untrusted networks and restrict access via firewall rules, reverse proxies, or VPN if internet exposure is not required. After patching, review Forms server logs for unexplained sessions, unexpected runtime processes, or configuration changes that could indicate prior compromise.