CVE-2026-83094
CriticalCVSS 9.8Summary
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Forms. CVSS 3.1 Base Score is 9.8.
Risk Assessment
The risk is critical as an attacker can fully take over Oracle Forms, potentially leading to loss of confidentiality, integrity, and availability.
Recommendation
Apply Oracle patches for affected versions. Restrict network access to Oracle Forms and implement authentication and monitoring mechanisms.
Other vulnerabilities in Oracle Forms
See all- CVE-2026-83108Critical
Vulnerability in Oracle Fusion Middleware Oracle Forms (component: Forms Services, C/S, Charmode) affecting versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can take over the system.
- CVE-2026-83107Critical
Vulnerability in Oracle Fusion Middleware Oracle Forms (component: Forms Services, C/S, Charmode) affecting versions 12.2.1.19.0 and 14.1.2.0.0. A high privileged authenticated attacker with network access via HTTP can take over the system, and the attack may also impact additional products (scope change).
- CVE-2026-83105Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Forms, and attacks may impact additional products (scope change). CVSS 3.1 Base Score is 9.0.
- CVE-2026-83104Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via TCP can gain unauthorized access to critical data and modify or delete it. CVSS 3.1 Base Score is 9.1.
- CVE-2026-83103Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. A high privileged attacker with network access via HTTP can compromise Oracle Forms, and attacks may impact additional products (scope change). CVSS 3.1 Base Score is 9.1.
- CVE-2026-83100Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Forms. CVSS 3.1 Base Score is 9.8.
- CVE-2026-83099Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Forms, and attacks may impact additional products (scope change). CVSS 3.1 Base Score is 10.0.
- CVE-2026-83098Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Forms. CVSS 3.1 Base Score is 9.8.
- CVE-2026-83095Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Forms. CVSS 3.1 Base Score is 9.8.
Original NVD description (English source)
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. Successful attacks of this vulnerability can result in takeover of Oracle Forms. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).