CVE-2026-83102

CVE-2026-83102 is a difficult-to-exploit vulnerability in the Forms Services (C/S, Charmode) component of Oracle Forms, part of Oracle Fusion Middleware. An unauthenticated remote attacker with network access via HTTP can trigger the flaw, and successful attacks allow unauthorized creation, deletion, or modification of critical data — or of all Oracle Forms-accessible data — as well as unauthorized read access to that data. The issue is rated CVSS 3.1 7.4 (high), with high confidentiality and integrity impact but no availability impact, and it affects Oracle Forms 12.2.1.19.0 and 14.1.2.0.0. Organizations exposing Oracle Forms endpoints over HTTP, particularly internet-facing Forms servlets for legacy enterprise applications, are the most relevant targets. No public proof of concept is known, the issue is not in the CISA Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83102 to Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 deployments. Restrict HTTP access to Forms Services endpoints so they are reachable only from trusted networks or via authenticated reverse proxy, and audit Forms-accessible data for unauthorized creation, deletion, or modification. Inventory internet-facing Oracle Forms servlets and prioritize patching those, since the flaw is exploitable without authentication over HTTP.