CVE-2026-83099
CriticalCVSS 10.0Summary
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Forms, and attacks may impact additional products (scope change). CVSS 3.1 Base Score is 10.0.
Risk Assessment
The risk is maximum as an attacker can fully take over Oracle Forms and affect other systems, leading to complete loss of confidentiality, integrity, and availability.
Recommendation
Immediately apply Oracle patches for affected versions. Restrict network access to Oracle Forms and consider additional security measures such as WAF.
Other vulnerabilities in Oracle Forms
See all- CVE-2026-83108Critical
Vulnerability in Oracle Fusion Middleware Oracle Forms (component: Forms Services, C/S, Charmode) affecting versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can take over the system.
- CVE-2026-83107Critical
Vulnerability in Oracle Fusion Middleware Oracle Forms (component: Forms Services, C/S, Charmode) affecting versions 12.2.1.19.0 and 14.1.2.0.0. A high privileged authenticated attacker with network access via HTTP can take over the system, and the attack may also impact additional products (scope change).
- CVE-2026-83105Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Forms, and attacks may impact additional products (scope change). CVSS 3.1 Base Score is 9.0.
- CVE-2026-83104Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via TCP can gain unauthorized access to critical data and modify or delete it. CVSS 3.1 Base Score is 9.1.
- CVE-2026-83103Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. A high privileged attacker with network access via HTTP can compromise Oracle Forms, and attacks may impact additional products (scope change). CVSS 3.1 Base Score is 9.1.
- CVE-2026-83100Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Forms. CVSS 3.1 Base Score is 9.8.
- CVE-2026-83098Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Forms. CVSS 3.1 Base Score is 9.8.
- CVE-2026-83095Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Forms. CVSS 3.1 Base Score is 9.8.
- CVE-2026-83094Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Forms. CVSS 3.1 Base Score is 9.8.
Original NVD description (English source)
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. While the vulnerability is in Oracle Forms, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Forms. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).