This vulnerability affects Oracle Forms components in Oracle Fusion Middleware, specifically versions 12.2.1.19.0 and 14.1.2.0.0. It is difficult to exploit and requires network access via HTTP and user interaction from someone other than the attacker. Exploitation can result in unauthorized creation, deletion, or modification of critical data, unauthorized access to all Oracle Forms data, and partial denial of service. The vulnerability has a CVSS 3.1 score of 7.9 with vector AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L, indicating network attack vector, high attack complexity, low privileges required, user interaction required, scope change, and high confidentiality and integrity impact with low availability impact. Oracle’s September 2026 Critical Security Patch Update includes patches for this vulnerability among 673 others. Oracle advises customers to remain on supported versions and apply patches without delay to mitigate exploitation risks.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Forms, unauthorized access to all Oracle Forms accessible data, and the ability to cause a partial denial of service. The vulnerability also has scope to affect additional Oracle products beyond Oracle Forms. The CVSS score of 7.9 indicates a high impact on confidentiality and integrity, with a lower impact on availability.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No indication of alternative mitigations or that no action is required was provided.