CVE-2026-83105

Received Received - Intake

Oracle Forms Remote Code Execution Vulnerability

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: Oracle

Description

Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. While the vulnerability is in Oracle Forms, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Forms. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-05

NVD

CVE-2026-83105

EUVD

EUVD-2026-79433

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	forms	12.2.1.19.0
oracle	forms	14.1.2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Forms, a component of Oracle Fusion Middleware. It allows an unauthenticated attacker with network access via HTTP to potentially take over the Oracle Forms system. The vulnerability has a high CVSS score of 9.0, indicating significant impact on confidentiality, integrity, and availability.

Detection Guidance

Detection of CVE-2026-83105 requires monitoring for unusual activity in Oracle Forms services. Check for unauthorized HTTP requests targeting Oracle Forms components. Inspect logs for signs of exploitation attempts or unexpected system behavior. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could allow an attacker to take control of Oracle Forms, leading to potential data breaches, unauthorized access to sensitive information, or disruption of services. The impact may extend to other connected systems due to the scope change mentioned.

Compliance Impact

This vulnerability allows unauthenticated attackers to compromise Oracle Forms, potentially leading to unauthorized access, data breaches, or system takeover. Such impacts could violate GDPR (data protection) and HIPAA (health data security) by exposing sensitive information or disrupting critical systems.

Mitigation Strategies

Apply the latest Oracle Forms patches or updates provided by Oracle to address the vulnerability. Ensure network access controls restrict HTTP access to Oracle Forms components. Monitor Oracle security advisories for additional mitigation guidance.

Hi! I’m here to help you understand CVE-2026-83105. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70