Oracle has disclosed a CVSS 9.1 vulnerability in Oracle Forms, part of Oracle Fusion Middleware, that Oracle's advisory describes as allowing a network-based attacker with high privileges to take over the product, with attacks that may also affect adjacent systems.
What Is It
CVE-2026-83107 is a vulnerability in the Oracle Forms product of Oracle Fusion Middleware, specifically in the Forms Services, C/S, Charmode component. Oracle describes it as easily exploitable, allowing an attacker with high privileges and network access via HTTP to compromise Oracle Forms. Per Oracle, successful exploitation results in full takeover of Oracle Forms.
The flaw carries a CVSS 3.1 base score of 9.1 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The record was published on 2026-09-15 by Oracle's security alert contact and currently sits in "Received" status at NVD.
Why It Matters
Two things push this beyond a routine middleware bug. First, the scope is changed: Oracle explicitly warns that while the vulnerability lives in Oracle Forms, attacks "may significantly impact additional products." The scope change is the CVSS signal that the blast radius may extend past the Forms instance itself, though Oracle does not enumerate which adjacent products are affected or how.
Second, the impact is total across all three axes: confidentiality, integrity, and availability are each rated High. Combined with low attack complexity and no user interaction requirement, an attacker who already holds privileged access on a Forms deployment is well positioned to compromise it fully, and potentially to reach systems beyond it.
The mitigating factor is the privilege requirement (PR:H). This is not an unauthenticated internet-facing takeover; the attacker needs high privileges first. That makes it most relevant as a post-compromise escalation and lateral movement primitive, or as an insider-threat scenario.
What's Vulnerable
Oracle lists two affected supported versions of Oracle Forms:
- 12.2.1.19.0
- 14.1.2.0.0
No CPE entries were available in the NVD record at time of writing, so asset inventories should be checked against the version strings directly.
Patch Status
Oracle ships security fixes on a fixed quarterly Critical Patch Update cadence, January, April, July, and October, so this CVE's 2026-09-15 publication date falls between scheduled CPU releases. The supplied data does not identify which Oracle release carries the fix. Administrators running either affected version should check Oracle's security alerts index directly to confirm whether a fix has shipped in a CPU or an out-of-band security alert, and apply it accordingly.
As of this writing, a check of the CISA Known Exploited Vulnerabilities catalog does not list CVE-2026-83107, and no active exploitation has been confirmed in the supplied data. The KEV catalog is updated frequently, so operators should re-check it directly rather than treating this status as durable.
Sources
- Oracle Security Alerts index (Critical Patch Updates and security alerts): https://www.oracle.com/security-alerts/
- NVD, CVE-2026-83107: https://nvd.nist.gov/vuln/detail/CVE-2026-83107
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog