CVE-2026-83099

CVE-2026-83099 is a critical (CVSS 3.1 base score 10.0) unauthenticated vulnerability in the Forms Services client/server and character-mode components of Oracle Forms, part of Oracle Fusion Middleware. It is triggered remotely over HTTP by an attacker with no credentials and no user interaction, and successful exploitation results in a complete takeover of Oracle Forms with full impact to confidentiality, integrity, and availability. The CVSS vector includes a scope change (S:C), meaning attacks against the vulnerable Forms component can also significantly impact additional products on the compromised host. Affected deployments are Oracle Forms 12.2.1.19.0 and 14.1.2.0.0. No public proof of concept exists, the flaw is not on the CISA Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported to date.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83099 to all Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 installations as an emergency change, prioritizing any Forms Services endpoints reachable over the network. Remove internet exposure for Forms servlets and restrict access to trusted networks or VPN, and place the service behind an authenticating reverse proxy where possible. Review HTTP access logs for unauthenticated requests to Forms Services endpoints and watch for anomalous process or file activity on Forms hosts, since the scope change means adjacent products on the same server may be impacted after compromise.