CVE-2026-83098

CVE-2026-83098 is a critical (CVSS 9.8) vulnerability in the Forms Services, C/S, Charmode component of Oracle Forms, part of Oracle Fusion Middleware. An unauthenticated remote attacker with network access via HTTP can exploit it easily, without any privileges or user interaction, and fully compromise the Oracle Forms installation, with high impact on confidentiality, integrity, and availability — effectively a takeover of the affected Forms server. The supported affected versions are 12.2.1.19.0 and 14.1.2.0.0. Organizations exposing Oracle Forms servlet endpoints (common for legacy enterprise applications) are the primary at-risk population. No public proof-of-concept or confirmed in-the-wild exploitation is currently known, and the CVE is not on the CISA Known Exploited Vulnerabilities list.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83098 to systems running Oracle Forms 12.2.1.19.0 or 14.1.2.0.0. Until patched, restrict network access to Forms Services endpoints (VPN, allowlisting, or WAF rules) and ensure Forms servlets are not exposed directly to the internet. Review HTTP access logs for unauthenticated or anomalous requests to Forms Services URLs as an indicator of attempted exploitation.