This vulnerability affects Oracle Forms components within Oracle Fusion Middleware, specifically versions 12.2.1.19.0 and 14.1.2.0.0. It is exploitable remotely without authentication over TCP, enabling attackers to gain unauthorized access and perform unauthorized data manipulation or access. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects that the attack requires no privileges or user interaction and can be performed over the network with low complexity, resulting in high confidentiality and integrity impacts. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update (CSPU), which contains targeted security fixes across multiple products including Oracle Forms.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible via Oracle Forms. This compromises data confidentiality and integrity but does not affect availability. The vulnerability is remotely exploitable without authentication, increasing the risk of widespread impact if unpatched.

Oracle has released security patches addressing this vulnerability as part of its September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed as available via the official Oracle advisory. No alternative mitigations or workarounds are specified in the advisory.