CVE-2026-83106

Oracle Forms Improper Authorization Allows Remote Takeover

Published Sep 15, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Forms. Successful attacks of this vulnerability can result in takeover of Oracle Forms. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Analysis

Technical impact

The flaw in Oracle Forms Services, specifically within the client/server and Charmode components, allows an attacker with low privileged network access to take complete control of the Forms service. By leveraging this, the attacker can compromise the confidentiality, integrity, and availability of the application. The weakness relates to improper authorization (CWE-284).

Affected Systems

Oracle Forms product from Oracle Corporation, affecting versions 12.2.1.19.0 and 14.1.2.0.0 which are part of the Oracle Fusion Middleware stack.

Risk and Exploitability

The vulnerability carries a CVSS v3.1 base score of 7.5, indicating high impact if exploited. The EPSS score is less than 1 %, suggesting a low probability of exploitation in the short term, and it is not listed in CISA’s KEV catalog. The attack vector, inferred from the description, requires only network access to the Forms HTTP service and does not require elevated privileges, making it potentially reachable from remote locations.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

Oracle Forms

affected

Version	Status	Constraints
`12.2.1.19.0`	affected	—
`14.1.2.0.0`	affected	—

No data.

Vendor Product Versions

Oracle

Forms

Version	Status	Scheme	Platform
`12.2.1.19.0`	affected	generic	—
`14.1.2.0.0`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Oracle Forms patch or upgrade to a non‑affected version, following Oracle’s security update procedures.
Restrict HTTP access to the Forms service by configuring firewalls or access control lists to limit traffic to trusted IP ranges.
Review and enforce strict authentication and authorization settings within Forms to ensure users have only the permissions necessary for their roles.

Generated by OpenCVE AI on September 20, 2026 at 11:39 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.323% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.oracle.com/security-alerts/cspusep2026.html

History

Sep 20, 2026 12:00 PM Title updated View changes

Type	Values Removed	Values Added
Title		Oracle Forms Improper Authorization Allows Remote Takeover

Sep 20, 2026 10:45 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Remote Takeover of Oracle Forms via HTTP in Oracle Fusion Middleware
Weaknesses	CWE-287

Sep 17, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 17, 2026 2:45 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Remote Takeover of Oracle Forms via HTTP in Oracle Fusion Middleware
Weaknesses		CWE-284 CWE-287

Sep 15, 2026 8:15 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Forms. Successful attacks of this vulnerability can result in takeover of Oracle Forms. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared		Oracle Oracle forms
CPEs		cpe:2.3:a:oracle:forms:12.2.1.19.0:::::::* cpe:2.3:a:oracle:forms:14.1.2.0.0:::::::*
Vendors & Products		Oracle Oracle forms
References		https://www.oracle.com/security-alerts/cspusep2026.html
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`