This vulnerability affects Oracle Forms, a component of Oracle Fusion Middleware. It allows a high privileged attacker with network access via HTTP to perform unauthorized data manipulation and cause denial of service by hanging or crashing Oracle Forms. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts. The affected versions are 12.2.1.19.0 and 14.1.2.0.0. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides targeted security fixes. Customers are strongly advised to apply the relevant patches promptly.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all data accessible through Oracle Forms. It can also cause Oracle Forms to hang or crash repeatedly, leading to a complete denial of service. There is no confidentiality impact reported. The vulnerability requires high privileges and network access via HTTP.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply these official patches without delay to remediate the vulnerability. Oracle strongly recommends staying on actively supported versions and promptly applying security patches. Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are specified.