CVE-2026-83107

Oracle Forms Remote Privilege Escalation via HTTP

Published Sep 15, 2026 CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Description

Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Forms. While the vulnerability is in Oracle Forms, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Forms. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

Analysis

Technical impact

This vulnerability in Oracle Forms allows an attacker with network access to a compromised HTTP interface to elevate privileges and take full control of the application. The flaw results in complete loss of confidentiality, integrity and availability for the affected instance. The disclosed CVSS vector indicates a network attack that can be performed with low effort and high privilege impact, resulting in a 9.1 base score.

Affected Systems

Oracle Forms product of Oracle Fusion Middleware, versions 12.2.1.19.0 and 14.1.2.0.0 are affected. The vulnerability exists in the Forms Services, Client/Server, Charmode components. These versions are currently supported under Oracle’s release schedule.

Risk and Exploitability

The CVSS score of 9.1 marks this as a critical issue, and although the EPSS score is presently less than 1%, the fact that it is exploitable over HTTP makes it a priority for defense. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, but the potential for a full takeover means it could be a high‑profile target should an attacker discover it. Based on the description, the likely attack vector is a network‑based HTTP request that bypasses normal authentication checks, allowing an attacker to obtain high‑privilege control of the Forms instance.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

Oracle Forms

affected

Version	Status	Constraints
`12.2.1.19.0`	affected	—
`14.1.2.0.0`	affected	—

No data.

Vendor Product Versions

Oracle

Forms

Version	Status	Scheme	Platform
`12.2.1.19.0`	affected	generic	—
`14.1.2.0.0`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Review the Oracle security alert (https://www.oracle.com/security-alerts/cspusep2026.html) for the latest guidance and check for any available patches.
Restrict HTTP access to the Oracle Forms service to trusted networks or clients by applying firewall or reverse proxy rules.
Monitor Forms service logs for unusual or unauthorized HTTP requests and investigate any anomalies.
Apply any official Oracle Forms security updates as they are released; ensure the affected versions (12.2.1.19.0 and 14.1.2.0.0) are updated.

Generated by OpenCVE AI on September 20, 2026 at 11:20 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.462% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.oracle.com/security-alerts/cspusep2026.html

History

Sep 20, 2026 11:45 AM Title updated View changes

Type	Values Removed	Values Added
Title		Oracle Forms Remote Privilege Escalation via HTTP

Sep 20, 2026 10:00 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Remote Privilege Escalation Exploitable via HTTP in Oracle Forms
Weaknesses	CWE-269

Sep 17, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 17, 2026 2:45 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Remote Privilege Escalation Exploitable via HTTP in Oracle Forms
Weaknesses		CWE-269 CWE-284

Sep 15, 2026 8:15 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Forms. While the vulnerability is in Oracle Forms, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Forms. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
First Time appeared		Oracle Oracle forms
CPEs		cpe:2.3:a:oracle:forms:12.2.1.19.0:::::::* cpe:2.3:a:oracle:forms:14.1.2.0.0:::::::*
Vendors & Products		Oracle Oracle forms
References		https://www.oracle.com/security-alerts/cspusep2026.html
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}`