Oracle Reports Developer CVE-2026-62627

Exploitation requires a valid low-privileged account on the Oracle Reports Developer instance (PR:L) - anonymous, unauthenticated access is not sufficient. The attack is conducted over HTTP against a network-accessible instance (AV:N), so the service must be reachable from the attacker's network segment. High attack complexity (AC:H) imposes additional prerequisites that Oracle has not fully documented in public disclosures; these likely involve specific application state, configuration, or interaction sequence within the Security and Authentication component. The scope change (S:C) means that a successful exploit must also have conditions in place for Oracle Reports Developer to have trust relationships or shared data access with additional Fusion Middleware products - isolated deployments would not experience the broader scope impact. No user interaction is required (UI:N), meaning the attack is fully attacker-driven once prerequisites are met.

The CVSS 3.1 score of 7.1 is driven primarily by high confidentiality impact and scope change, partially offset by High attack complexity (AC:H) and the requirement for low privileges (PR:L). Real-world risk is meaningful but not immediate: the AC:H rating means exploitation is not trivial and likely requires specific timing, configuration state, or knowledge of internal behavior - deterring opportunistic attackers. No EPSS data was provided in the input, so exploitation probability cannot be quantified. Neither CISA KEV listing nor public proof-of-concept code has been identified, indicating no confirmed active exploitation at time of analysis. The scope change is the most operationally significant signal: a successful compromise of Oracle Reports Developer could pivot to affect other Fusion Middleware components or integrated Oracle data sources, amplifying blast radius beyond initial access. Priority should be elevated for organizations running integrated Fusion Middleware stacks where Reports Developer is exposed to authenticated internal users or federated identities.

An attacker holding any low-privileged Oracle Reports Developer account - such as a standard report viewer - sends a specially crafted HTTP request targeting a flaw in the Security and Authentication component, bypassing normal authorization enforcement. By satisfying the specific conditions required to clear the high attack complexity bar (AC:H), the attacker elevates effective access and retrieves the complete data corpus accessible to Oracle Reports Developer, potentially including sensitive Oracle data source content. If scope change conditions are met, the attacker may also gain unauthorized read or write access to other Fusion Middleware components sharing the same environment. No public proof-of-concept exploit code has been identified at time of analysis.