CVE-2026-83104

Analyzed Analyzed - Analysis Complete

Oracle Forms Unauthorized Data Access Vulnerability

Publication date: 2026-09-15

Last updated on: 2026-09-23

Assigner: Oracle

Description

Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Forms. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Forms accessible data as well as unauthorized access to critical data or complete access to all Oracle Forms accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-23

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-83104

EUVD

EUVD-2026-79432

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	forms	12.2.1.19.0
oracle	forms	14.1.2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Forms, part of Oracle Fusion Middleware. It affects versions 12.2.1.19.0 and 14.1.2.0.0. An unauthenticated attacker can exploit it remotely via TCP to compromise the system. Successful exploitation may allow unauthorized creation, deletion, or modification of critical data or access to all Oracle Forms data.

Detection Guidance

This vulnerability affects Oracle Forms versions 12.2.1.19.0 and 14.1.2.0.0. Detection requires checking installed Oracle Forms versions and verifying network exposure of the Forms Services component. Use commands like 'opatch lsinventory' to check installed versions and network scans to identify exposed TCP ports used by Oracle Forms.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized access to sensitive data, modification or deletion of critical information, or complete compromise of Oracle Forms accessible data. This could disrupt business operations and expose confidential information.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR and HIPAA requirements for data confidentiality and integrity. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Apply the latest Oracle Forms patches immediately as they become available. Restrict network access to Oracle Forms ports via firewalls. Monitor for unusual data modification or creation activities in Oracle Forms. Disable unnecessary services if not in use.

Hi! I’m here to help you understand CVE-2026-83104. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70