CVE-2026-83108
CriticalCVSS 9.8Summary
Vulnerability in Oracle Fusion Middleware Oracle Forms (component: Forms Services, C/S, Charmode) affecting versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can take over the system.
Risk Assessment
Successful exploitation leads to full takeover of Oracle Forms, posing a critical threat to confidentiality, integrity and availability of processed data.
Recommendation
Immediately apply Oracle security updates for Oracle Forms and restrict network access to the Forms Services.
Other vulnerabilities in Oracle Forms
See all- CVE-2026-83107Critical
Vulnerability in Oracle Fusion Middleware Oracle Forms (component: Forms Services, C/S, Charmode) affecting versions 12.2.1.19.0 and 14.1.2.0.0. A high privileged authenticated attacker with network access via HTTP can take over the system, and the attack may also impact additional products (scope change).
- CVE-2026-83105Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Forms, and attacks may impact additional products (scope change). CVSS 3.1 Base Score is 9.0.
- CVE-2026-83104Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via TCP can gain unauthorized access to critical data and modify or delete it. CVSS 3.1 Base Score is 9.1.
- CVE-2026-83103Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. A high privileged attacker with network access via HTTP can compromise Oracle Forms, and attacks may impact additional products (scope change). CVSS 3.1 Base Score is 9.1.
- CVE-2026-83100Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Forms. CVSS 3.1 Base Score is 9.8.
- CVE-2026-83099Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Forms, and attacks may impact additional products (scope change). CVSS 3.1 Base Score is 10.0.
- CVE-2026-83098Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Forms. CVSS 3.1 Base Score is 9.8.
- CVE-2026-83095Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Forms. CVSS 3.1 Base Score is 9.8.
- CVE-2026-83094Critical
Vulnerability in Oracle Forms (component: Forms Services, C/S, Charmode) affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Forms. CVSS 3.1 Base Score is 9.8.
Original NVD description (English source)
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. Successful attacks of this vulnerability can result in takeover of Oracle Forms. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).