CVE-2026-83096

CVE-2026-83096 is a difficult-to-exploit vulnerability in the Forms Services (C/S, Charmode) component of Oracle Forms, part of Oracle Fusion Middleware, affecting versions 12.2.1.19.0 and 14.1.2.0.0. A low-privileged remote attacker with HTTP access to the Forms Services endpoint can trigger the flaw, but a successful attack additionally requires interaction from a victim user other than the attacker (per the CVSS vector UI:R), suggesting a social-engineering or request-forgery style trigger. If exploited, the attacker gains unauthorized creation, deletion, or modification of critical data or all Oracle Forms-accessible data, unauthorized read access to that data, and a partial denial of service against Oracle Forms; the scope change (S:C) means successful attacks can also significantly impact products beyond Oracle Forms itself. Affected parties are enterprises running the listed Forms releases, typically internet- or intranet-facing legacy business applications. No public proof of concept exists and the flaw is not on the CISA Known Exploited Vulnerabilities catalog, so exploitation is presumed none known at this time.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83096 to versions beyond 12.2.1.19.0 and 14.1.2.0.0 as soon as it is available for your release line. Restrict network access to Forms Services endpoints (VPN/IP allowlisting) and enforce strong authentication and least-privilege accounts for low-privilege Forms users. Because exploitation requires victim interaction, brief users on suspicious links/requests, and audit Forms-accessible data for unauthorized creation, modification, or deletion.