EUVD-2026-61599
GHSA-mf33-5xhc-2pgr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate exposed Oracle Reports UDP listener
-
DeliverySend crafted UDP packet to auth service
-
ExploitBypass Security and Authentication
-
ExecutionTake over Reports Developer
-
ImpactAccess or alter reports and data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Oracle Reports Developer 'Security and Authentication' service over UDP on a system running the affected 12.2.1.19.0 release; per CVSS AV:N/AC:L/PR:N/UI:N there is no authentication, no user interaction, and no special product configuration called out by Oracle beyond running the vulnerable version. The primary limiting factor is exposure of the vulnerable UDP listener - environments that firewall or segment the Reports Server so its UDP service is not reachable from untrusted networks are not exploitable from those networks. Applicability is confined to version 12.2.1.19.0 of this specific Fusion Middleware component. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) signals a maximal-severity, low-complexity, unauthenticated, network-reachable flaw resulting in full takeover - the highest-priority profile on paper. However, key corroborating signals are absent: no EPSS score, no SSVC decision, and no CWE were supplied, and the vulnerability is not in CISA KEV, so there is no evidence of active exploitation. There is also an internal inconsistency: the source tag labels this 'Information Disclosure', while the CVSS vector and Oracle's own text assert integrity and availability impact plus 'takeover' - the tag understates the rated impact and should not be trusted over the vector. The UDP attack vector is unusual and warrants verification against the actual deployment, since whether the vulnerable UDP listener is network-exposed in a given environment materially changes real-world risk. Net: treat as a high-priority patch given the 9.8 unauthenticated profile, but note that exploitation-probability data (EPSS) and any POC are currently unknown. |
| Exploit ScenarioDerived | An attacker with network reachability to an exposed Oracle Reports Developer instance sends crafted UDP traffic to the vulnerable Security and Authentication service, bypassing authentication and gaining control of the product without credentials or user interaction. Because CVSS complexity is Low and no privileges are required, exploitation is straightforward once the UDP listener is reachable; no public POC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Remote takeover in Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) lets an unauthenticated network attacker fully compromise the product via UDP. Oracle rates the flaw CVSS 9.8 with high confidentiality, integrity, and availability impact and describes it as easily exploitable. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Apply Oracle's August 2026 Critical Patch Update, which addresses this issue per the vendor advisory at https://www.oracle.com/security-alerts/cspuaug2026.html; this is patch available per vendor advisory, and since no discrete fixed-version string was provided beyond the CPU, confirm the exact patch or bundle for 12.2.1.19.0 in the CPU matrix. Because the vector is unauthenticated network access via UDP, the most effective compensating control until patching is to restrict network reachability of the Reports Server and its listener by blocking or firewalling the relevant UDP ports so they are reachable only from trusted management hosts, and by placing Oracle Reports behind a segmented network or VPN rather than exposing it to untrusted networks; the trade-off is that legitimate remote report clients or discovery traffic using that UDP service may break and must be explicitly allowlisted. Given the affected 'Security and Authentication' component, also review and rotate any credentials or trust configuration after patching in case authentication state was exposed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Reports Developer is the reporting engine within the Oracle Fusion Middleware / Oracle Reports stack, historically used to design and serve enterprise reports through the Reports Server and associated network listeners. The affected component is 'Security and Authentication', indicating the weakness sits in the authentication or session-handling layer rather than in report rendering. Oracle attributes exploitation to network access 'via UDP', which is atypical for what is usually an HTTP/RWServlet-fronted product and points to a listener or discovery service reachable over UDP. No CWE was assigned by Oracle or NVD, so the precise root-cause class (for example authentication bypass versus a memory-safety flaw) cannot be confirmed from the available data.
Know when Reports Developer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle describes unauthenticated, easily exploitable network access via UDP yielding full takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H and scope unchanged as impact stays within the product.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 12.2.1.19.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via UDP to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in takeover of Oracle Reports Developer. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 enables unauthenticated network attackers to achieve complete remote system compromise without credentials or exploitation complexity. Organizations running this Oracle Fusion Middleware component face immediate risk of full takeover and data exposure, with no vendor patch currently available.
Implement strict network-layer access controls limiting connections to Oracle Reports Developer 12.2.1.19.0 to authorized administrative networks only; disable the component entirely if not business-critical; segment affected systems from critical data and infrastructure; monitor network traffic for suspicious activity; consider temporarily disabling UDP access to affected hosts until a patch is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Reports Developer
View allVulnerability in the Oracle Reports Developer component of Oracle Fusion Middleware (subcomponent: Valid Session). Rated
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible when a low-privileged att
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component)
Full takeover of Oracle Reports Developer 14.1.2.0.0 (a component of Oracle Fusion Middleware) is possible for a remote,
Full compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware) is possible by a remote, unauthenticat
Complete takeover of Oracle Reports Developer 12.2.1.19.0 is achievable by a remote, unauthenticated attacker over HTTP,
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component)
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible for a remote, unauthenticated attacker who can reac
Full system takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication compo
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible by a remote, unauthenticated attacker over TCP, per
Full compromise of Oracle Reports Developer 12.2.1.19.0 is possible when an unauthenticated attacker reaches the product
Remote takeover of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component
Exploit-DB