Oracle Forms CVE-2026-83100

Exploitation requires network access to an Oracle Forms Services (C/S, Charmode) endpoint reachable over HTTP, running affected version 12.2.1.19.0 or 14.1.2.0.0. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are stated to be required - meaning default HTTP-exposed deployments are exploitable. The primary limiting factors are deployment-related rather than technical: Oracle Forms is legacy enterprise middleware typically deployed behind application/web tiers and often not directly internet-facing, which constrains the realistic attack surface. The specific Forms Services C/S Charmode component being the vector suggests character-mode client/server deployments in particular.

This is a genuinely high-priority vulnerability by every available signal, though real-world urgency is tempered by product footprint. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes remote, unauthenticated, low-complexity exploitation over HTTP with no user interaction, yielding full compromise ("takeover") of Oracle Forms - a full CIA-triad impact consistent with CWE-287 authentication bypass. The 9.8 score is well-calibrated: S:U (not S:C) correctly keeps it below the 10.0 reserved for scope-changing pre-auth flaws like the WebLogic Web Container issue, and the pre-auth claim is honest given PR:N. However, the exploitation-likelihood signals are all absent/negative: no EPSS score is provided, there is no CISA KEV listing, and no public POC is identified - so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data supplied. The one meaningful gap is that Oracle's Critical Patch Update (cspusep2026) provides zero technical detail on the root cause or attack surface, so the specific pre-auth mechanism cannot be independently verified. Net: treat as a high-priority PATCH-NOW item wherever Oracle Forms 12.2.1.19.0 or 14.1.2.0.0 is exposed to HTTP, but the low real-world exploitation signals suggest this is currently a theoretical-but-serious risk rather than confirmed active targeting. This is a near-identical sibling to CVE-2026-83094 (same product, component, versions, and vector) from the same September 2026 Oracle CPU.

An unauthenticated attacker with network reachability to an exposed Oracle Forms Services (C/S, Charmode) HTTP endpoint sends a crafted request that bypasses authentication and achieves full takeover of the Oracle Forms instance, gaining read/write control and the ability to disrupt availability. No credentials, user interaction, or special configuration are required per the CVSS vector. No public exploit code has been identified, so exploitation would currently require attacker-developed tooling given Oracle's non-disclosure of technical detail.