CVE-2026-83107
CriticalCVSS 9.1Summary
Vulnerability in Oracle Fusion Middleware Oracle Forms (component: Forms Services, C/S, Charmode) affecting versions 12.2.1.19.0 and 14.1.2.0.0. A high privileged authenticated attacker with network access via HTTP can take over the system, and the attack may also impact additional products (scope change).
Risk Assessment
Successful exploitation leads to full takeover of Oracle Forms and may affect related systems, posing a serious threat to confidentiality, integrity and availability of data.
Recommendation
Immediately apply the available Oracle security updates for Oracle Forms and restrict network access to the Forms Services to trusted administrators only.
Other vulnerabilities in Oracle Forms
See all- CVE-2026-83108Critical
Vulnerability in Oracle Fusion Middleware Oracle Forms (component: Forms Services, C/S, Charmode) affecting versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can take over the system.
- CVE-2026-83105Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Forms, and attacks may impact additional products (scope change). CVSS 3.1 Base Score is 9.0.
- CVE-2026-83104Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via TCP can gain unauthorized access to critical data and modify or delete it. CVSS 3.1 Base Score is 9.1.
- CVE-2026-83103Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. A high privileged attacker with network access via HTTP can compromise Oracle Forms, and attacks may impact additional products (scope change). CVSS 3.1 Base Score is 9.1.
- CVE-2026-83100Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Forms. CVSS 3.1 Base Score is 9.8.
- CVE-2026-83099Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Forms, and attacks may impact additional products (scope change). CVSS 3.1 Base Score is 10.0.
- CVE-2026-83098Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Forms. CVSS 3.1 Base Score is 9.8.
- CVE-2026-83095Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Forms. CVSS 3.1 Base Score is 9.8.
- CVE-2026-83094Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Forms. CVSS 3.1 Base Score is 9.8.
Original NVD description (English source)
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Forms. While the vulnerability is in Oracle Forms, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Forms. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).