CVE-2026-83105

CVE-2026-83105 is a difficult-to-exploit but critical (CVSS 9.0) unauthenticated vulnerability in Oracle Forms, a legacy enterprise application component of Oracle Fusion Middleware, specifically in the Forms Services C/S Charmode component. An unauthenticated attacker with network access via HTTP who succeeds despite the high attack complexity can fully compromise Oracle Forms, and due to a scope change, successful attacks may significantly impact additional products beyond Forms itself. Successful exploitation results in a complete takeover of Oracle Forms with high impact to confidentiality, integrity, and availability. Affected installations run Oracle Forms versions 12.2.1.19.0 or 14.1.2.0.0. No public proof of concept exists, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported to date.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83105 to Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 installations as soon as possible, prioritizing any Forms Services endpoints reachable over the internet. Until patched, restrict HTTP access to Forms endpoints via firewall rules or reverse-proxy allowlisting, and consider placing Forms behind VPN/authentication. Review logs for anomalous unauthenticated requests to Forms Services endpoints and any unexpected process or configuration changes on Forms hosts, given the scope change means adjacent products may also be impacted.