This vulnerability affects Oracle Forms components within Oracle Fusion Middleware, specifically versions 12.2.1.19.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to compromise the product, potentially resulting in unauthorized creation, deletion, or modification of critical data or complete access to all Oracle Forms accessible data. The vulnerability has a CVSS 3.1 score of 7.4 with high confidentiality and integrity impacts, and requires high attack complexity. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted security fixes for Oracle Forms and other products. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Forms, as well as unauthorized access to all data accessible by Oracle Forms. This compromises confidentiality and integrity of the affected data. The vulnerability does not impact availability. The attack requires network access via HTTP but no authentication, though it is considered difficult to exploit.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the official patches for Oracle Forms versions 12.2.1.19.0 and 14.1.2.0.0 promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate this vulnerability. No alternative mitigations or workarounds are specified in the advisory.