CVE-2026-83107

CVE-2026-83107 is a critical (CVSS 9.1) vulnerability in the Forms Services, C/S, Charmode component of Oracle Forms, part of Oracle Fusion Middleware, affecting versions 12.2.1.19.0 and 14.1.2.0.0. It is easily exploitable by a high-privileged attacker who has network access to the Forms server via HTTP, requiring no user interaction. Because of a scope change, successful attacks on Oracle Forms can significantly impact additional products beyond the vulnerable component. A successful exploit results in complete takeover of Oracle Forms with high impacts to confidentiality, integrity, and availability. No public proof-of-concept exists and the flaw is not in CISA's Known Exploited Vulnerabilities catalog, so exploitation is not currently observed.

What to do: Apply the Oracle Critical Patch Update that addresses this flaw for Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 as soon as it is available. Restrict HTTP access to Forms Services endpoints (for example the Forms servlet) using VPN or IP allowlisting so only trusted high-privileged users can reach them, and audit those accounts for signs of misuse. Review logs for suspicious privileged activity and rotate credentials for Forms administrator and application accounts.