Oracle Reports Developer CVE-2026-62626

The only hard prerequisite is network HTTP reachability to the Oracle Reports Developer service (the Reports Server/rwservlet, typically exposed via Oracle HTTP Server or WebLogic); with AV:N/AC:L/PR:N/UI:N there is no authentication, no user interaction, and no special non-default configuration required - this is unauthenticated remote exploitation against the affected 12.2.1.19.0 build. The practical limiting factor is exposure: the affected version must be 12.2.1.19.0 specifically, and the Reports HTTP endpoint must be reachable by the attacker, so deployments where the Reports servlet is firewalled to internal trusted networks or fronted by an authenticating proxy materially reduce real-world reachability.

The signals point to a genuine high priority rather than an inflated score: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N gives network reachability, low complexity, no privileges, and no user interaction, with C:H/I:H/A:H producing 9.8, and Oracle explicitly describes 'easily exploitable' unauthenticated takeover. No EPSS value was provided in the source data and no CISA KEV listing or public POC is present, so there is currently no evidence of active exploitation to corroborate the CVSS - high-severity and actively-exploited are distinct signals and should not be conflated here. One inconsistency worth flagging: the source tags label this 'Information Disclosure', yet the CVSS shows full integrity and availability impact and the description states 'takeover', so the tag understates the real impact - trust the vector and Oracle's takeover language over the tag. Given how cheap unauthenticated network exploitation is, even a mid-sized municipal IT team in gdynia running this component should treat it as urgent rather than deferring to the next maintenance window. Because Oracle Reports is often intranet- or internet-exposed behind OHS, exposure assessment (is the Reports servlet reachable?) is the deciding factor for real-world risk.

An attacker who can reach the Oracle Reports HTTP endpoint sends a crafted request that abuses the Security and Authentication component, bypassing access controls without any credentials or user interaction. Because AC:L and PR:N apply, the request succeeds against a default deployment and results in full takeover of the Reports Developer instance, letting the attacker read, alter, or destroy report data and pivot into the middleware host. No public POC is known at time of analysis, so exploitation would require original research or reverse-engineering of the Oracle patch.