Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVE-2026-83101)
A vulnerability exists in Oracle Forms, part of Oracle Fusion Middleware, affecting versions 12.2.1.19.0 and 14.1.2.0.0. The flaw allows an unauthenticated attacker with network access via HTTP to potentially take over Oracle Forms. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.1, impacting confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes numerous fixes across multiple products. Customers are strongly advised to apply the available patches promptly.
AI Analysis
Technical Summary
CVE-2026-83101 is a high-severity vulnerability in Oracle Forms (components: Forms Services, C/S, Charmode) of Oracle Fusion Middleware. It affects supported versions 12.2.1.19.0 and 14.1.2.0.0. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Forms, potentially leading to full takeover. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, high attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability as part of a broad set of patches. Oracle strongly recommends applying these patches without delay to mitigate risk.
Potential Impact
Successful exploitation of this vulnerability can result in complete compromise of Oracle Forms, impacting confidentiality, integrity, and availability of the affected system. The vulnerability can be exploited remotely without authentication but requires network access via HTTP and has high attack complexity. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Oracle has released fixes for this vulnerability in the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle Forms versions 12.2.1.19.0 and 14.1.2.0.0 promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No additional mitigation steps are specified beyond patching.
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVE-2026-83101)
Description
A vulnerability exists in Oracle Forms, part of Oracle Fusion Middleware, affecting versions 12.2.1.19.0 and 14.1.2.0.0. The flaw allows an unauthenticated attacker with network access via HTTP to potentially take over Oracle Forms. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.1, impacting confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes numerous fixes across multiple products. Customers are strongly advised to apply the available patches promptly.
CVSS v3.1
Score 8.1high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-83101 is a high-severity vulnerability in Oracle Forms (components: Forms Services, C/S, Charmode) of Oracle Fusion Middleware. It affects supported versions 12.2.1.19.0 and 14.1.2.0.0. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Forms, potentially leading to full takeover. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, high attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability as part of a broad set of patches. Oracle strongly recommends applying these patches without delay to mitigate risk.
Potential Impact
Successful exploitation of this vulnerability can result in complete compromise of Oracle Forms, impacting confidentiality, integrity, and availability of the affected system. The vulnerability can be exploited remotely without authentication but requires network access via HTTP and has high attack complexity. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Oracle has released fixes for this vulnerability in the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle Forms versions 12.2.1.19.0 and 14.1.2.0.0 promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No additional mitigation steps are specified beyond patching.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-325c-7fqh-vfrm
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-83101"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aaa07e255bf5e2cf5ea3388
Added to database: 09/16/2026, 03:07:14 UTC
Last enriched: 09/16/2026, 04:30:29 UTC
Last updated: 09/16/2026, 05:01:22 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.