CVE-2026-83093

Analyzed Analyzed - Analysis Complete

Unauthenticated Access in Oracle Forms

Publication date: 2026-09-15

Last updated on: 2026-09-23

Assigner: Oracle

Description

Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. While the vulnerability is in Oracle Forms, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Forms accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-23

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-83093

EUVD

EUVD-2026-79421

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	forms	12.2.1.19.0
oracle	forms	14.1.2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Forms, a component of Oracle Fusion Middleware. It allows unauthenticated attackers to remotely access the system via HTTP and potentially gain unauthorized access to critical data or all data accessible through Oracle Forms. The vulnerability has a CVSS score of 8.6, indicating high severity due to confidentiality impacts.

Detection Guidance

This vulnerability involves Oracle Forms and requires network-based detection. Check for unusual HTTP traffic targeting Oracle Forms ports (typically 80, 443, or custom ports). Inspect logs for unauthenticated access attempts or unexpected data requests. Use network scanners to identify Oracle Forms instances and verify patch levels.

Impact Analysis

If you use Oracle Forms versions 12.2.1.19.0 or 14.1.2.0.0, an attacker could exploit this to access sensitive data without authentication. This could lead to data breaches, unauthorized modifications, or further attacks on connected systems.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Compliance may be compromised if data is exposed or mishandled due to the breach.

Mitigation Strategies

Apply the latest Oracle Forms patches or updates provided by Oracle to address the vulnerability. Ensure network access to Oracle Forms is restricted to trusted sources only. Monitor for unusual activity or unauthorized access attempts to the Oracle Forms component.

Hi! I’m here to help you understand CVE-2026-83093. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70