CVE-2026-83101

A difficult-to-exploit vulnerability in the Forms Services C/S Charmode component of Oracle Forms allows an unauthenticated attacker with network access via HTTP to compromise the product. Successful attacks can result in a complete takeover of Oracle Forms, with high impacts to confidentiality, integrity, and availability (CVSS 3.1 base score 8.1). Organizations running Oracle Fusion Middleware Forms releases 12.2.1.19.0 or 14.1.2.0.0 are affected. The high attack complexity means reliable exploitation is non-trivial, and no public proof-of-concept or confirmed in-the-wild exploitation has been reported. The flaw was assigned and patched by Oracle, most plausibly via a quarterly Critical Patch Update.

What to do: Apply the Oracle Critical Patch Update that addresses this CVE to Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 as soon as your patching cycle allows, since no workaround is indicated. Restrict network access to Forms Services endpoints so they are not reachable over unauthenticated HTTP from the internet, enforce TLS, and use firewall allowlists for known clients. Review Forms Services logs for anomalous unauthenticated requests and confirm no unauthorized configuration changes or account activity has occurred.