CVE-2026-83104

Oracle Forms, part of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode), contains an easily exploitable flaw in versions 12.2.1.19.0 and 14.1.2.0.0 that allows an unauthenticated remote attacker with TCP network access to compromise the service with no user interaction. Successful attacks can result in unauthorized creation, deletion, or modification of critical data — or of all data accessible through Oracle Forms — as well as unauthorized read access to that data, though availability is not impacted. The vulnerability carries a CVSS 3.1 base score of 9.1 (critical) driven by high confidentiality and integrity impacts. Organizations running the affected Forms versions with the service reachable over a network are at risk; no public proof of concept exists, the flaw is not on the CISA KEV list, and no in-the-wild exploitation is known.

What to do: Apply the Oracle Critical Patch Update fixes for Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 as soon as they are available for this CVE. Until patched, restrict TCP access to Forms Services to trusted networks or VPN clients and avoid exposing Forms ports directly to the internet. Audit Forms-accessible data for unauthorized creation, modification, or deletion and review service logs for anomalous unauthenticated sessions.