This vulnerability affects Oracle Forms, a component of Oracle Fusion Middleware, specifically versions 12.2.1.19.0 and 14.1.2.0.0. It allows a high privileged attacker with network access via HTTP to exploit the flaw easily, resulting in compromise and potential takeover of Oracle Forms. The vulnerability also has scope change implications, potentially affecting other Oracle products. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle's advisory confirms the availability of patches in their September 2026 Critical Security Patch Update.

Successful exploitation can lead to complete compromise of Oracle Forms, including full control over the affected component. The vulnerability impacts confidentiality, integrity, and availability, potentially allowing attackers to take over Oracle Forms and affect other Oracle products due to scope change. This represents a critical risk to affected environments.

Oracle has released security patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly. Oracle recommends remaining on actively supported versions and applying security updates without delay to mitigate exploitation risk. No alternative mitigations or workarounds are indicated in the advisory.