This vulnerability affects Oracle Forms within Oracle Fusion Middleware, specifically versions 12.2.1.19.0 and 14.1.2.0.0. It allows an unauthenticated attacker to remotely exploit the service over HTTP without any privileges or user interaction, resulting in full compromise of Oracle Forms. The vulnerability's scope change means that exploitation could impact other Oracle products beyond Oracle Forms. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects network attack vector, low attack complexity, no privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle has included fixes for this vulnerability in its September 2026 Critical Security Patch Update, which contains numerous security patches across multiple Oracle products.

An attacker exploiting this vulnerability can fully compromise Oracle Forms, gaining complete control over the affected service. This includes full confidentiality breach, integrity compromise, and denial of service. The vulnerability's scope change indicates that other Oracle products integrated or dependent on Oracle Forms may also be impacted. The critical CVSS score of 10.0 reflects the severity and ease of exploitation without authentication or user interaction.

Oracle has released security patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches for Oracle Forms versions 12.2.1.19.0 and 14.1.2.0.0 without delay. Oracle recommends remaining on actively supported versions and promptly applying security updates to mitigate exploitation risks. No alternative mitigations or workarounds are specified in the advisory.