CVE-2026-83102 is a vulnerability in the Oracle Forms product of Oracle Fusion Middleware, specifically affecting Forms Services components. It allows a remote unauthenticated attacker with network access via HTTP to compromise Oracle Forms. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible through Oracle Forms. The vulnerability has a CVSS 3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating high impact on confidentiality and integrity but requires high attack complexity. Affected versions explicitly include 12.2.1.19.0 and 14.1.2.0.0. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which contains 673 security patches across multiple products including Oracle Forms.

The vulnerability allows an unauthenticated remote attacker to gain unauthorized creation, deletion, or modification access to critical data within Oracle Forms or full access to all Oracle Forms accessible data. This compromises confidentiality and integrity of the affected systems. The attack complexity is high, and no privileges or user interaction are required. There are no reported known exploits in the wild at this time.

Oracle has released security patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate the risk. Oracle recommends remaining on actively-supported versions and applying security patches without delay. No additional mitigation steps are indicated beyond patching.