EUVD-2026-61603
GHSA-43j6-gp7v-8qxh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Reports Developer TCP service
-
DeliverySend crafted auth request
-
ExploitBypass Security and Authentication component
-
ExecutionGain control of Reports instance
-
ImpactFull product takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over TCP against Oracle Reports Developer 12.2.1.19.0, per CVSS AV:N/AC:L/PR:N/UI:N and Oracle's 'easily exploitable, unauthenticated' description. The practical limiting factor is network reachability of the Reports Server TCP listener: the attacker must be able to open a TCP connection to the service, so instances that are not internet-exposed and are segmented behind firewalls/VPNs are substantially harder to reach. Exploitation is confined to the affected version 12.2.1.19.0 as listed; other versions' exposure is unconfirmed. |
| Impact | The CVSS 3.1 signals are uniformly severe and internally consistent: network vector, low complexity, no privileges, no user interaction, unchanged scope, and high C/I/A yielding 9.8. Oracle's own language ('easily exploitable,' 'unauthenticated,' 'takeover') reinforces the vector rather than contradicting it, so there is no CVSS-versus-description conflict here. No EPSS score was supplied, no POC is referenced, and the CVE is not in CISA KEV, so there is currently no evidence of active or automated exploitation despite the maximal severity. The realistic priority is high because the barrier to exploitation is theoretically near-zero and Fusion Middleware components are attractive targets; however, absent EPSS/KEV/POC data the immediate probability of mass exploitation is unquantified, so this should be treated as a high-severity, patch-now item rather than a confirmed in-the-wild emergency. |
| Exploit ScenarioDerived | An attacker who can reach the Oracle Reports Developer TCP service across the network sends a crafted request that abuses the Security and Authentication component to bypass or subvert access control, requiring no credentials and no user interaction. Because impact is full takeover, the attacker gains control over the Reports Developer instance and its data. No public POC is referenced, so exploitation would currently require independent research or reverse engineering of the patch. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible via a Security and Authentication component flaw that lets a remote attacker take over the product over TCP without credentials or user interaction. Oracle rates it CVSS 9.8 with complete confidentiality, integrity, and availability loss, and describes it as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch in the August 2026 Critical Patch Update.
RemediationAI
Apply the fixes delivered in Oracle's August 2026 Critical Patch Update as documented at https://www.oracle.com/security-alerts/cspuaug2026.html; the advisory is the source of the patched builds for Oracle Reports Developer 12.2.1.19.0 (an exact fixed build string is not enumerated in the input, so consult the CPU patch matrix for the precise patch/bundle). Because exploitation is unauthenticated and network-based, if patching cannot be immediate, restrict network reachability of the Reports Server TCP listener to trusted management hosts via firewall/ACLs and place it behind a VPN or reverse proxy, accepting that this breaks direct client access and any integrations that connect to the Reports port. Additionally review and harden the Security and Authentication configuration and disable any unnecessary external exposure of the Reports service; note these controls reduce but do not eliminate risk and are not a substitute for the CPU patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Reports Developer is the reporting/design tier of Oracle Fusion Middleware, used to author and run enterprise reports served over the network, typically via the Reports Server listening on TCP. The affected component is 'Security and Authentication,' indicating the defect lies in the code path that establishes identity/access before serving report functionality, so the pre-authentication attack surface is directly implicated. Oracle did not assign a CWE (listed N/A), and no root-cause detail is published beyond the advisory; the vector (AV:N/AC:L/PR:N/UI:N) combined with 'takeover' impact is consistent with an authentication bypass or an unauthenticated pre-auth code/command execution weakness, but the exact class cannot be confirmed from the available data.
Know when Reports Developer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor describes easily exploitable unauthenticated network takeover with full C/I/A loss, giving AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H; scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 12.2.1.19.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in takeover of Oracle Reports Developer. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Reports Developer 12.2.1.19.0 contains a critical authentication bypass that allows unauthenticated remote attackers to gain complete system control without user interaction, directly compromising confidentiality, integrity, and availability of affected instances. The absence of a vendor patch significantly increases organizational risk for any systems dependent on this Oracle Fusion Middleware component. Immediate network isolation and compensating controls are essential pending patch availability.
No vendor-released patch identified at time of analysis. Implement firewall segmentation restricting access to authorized internal IP ranges only; disable the application if not actively required for business operations; enable comprehensive logging and 24/7 monitoring for connection attempts, failed authentications, and anomalous process execution; maintain isolated system backups separate from production infrastructure; establish incident response procedures specific to this vulnerability; restrict administrative access to affected systems pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Reports Developer
View allVulnerability in the Oracle Reports Developer component of Oracle Fusion Middleware (subcomponent: Valid Session). Rated
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible when a low-privileged att
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component)
Full takeover of Oracle Reports Developer 14.1.2.0.0 (a component of Oracle Fusion Middleware) is possible for a remote,
Full compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware) is possible by a remote, unauthenticat
Complete takeover of Oracle Reports Developer 12.2.1.19.0 is achievable by a remote, unauthenticated attacker over HTTP,
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component)
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible for a remote, unauthenticated attacker who can reac
Full system takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication compo
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible by a remote, unauthenticated attacker over TCP, per
Full compromise of Oracle Reports Developer 12.2.1.19.0 is possible when an unauthenticated attacker reaches the product
Remote takeover of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component
Exploit-DB