Oracle Reports Developer CVE-2026-62628

No special conditions are required - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against the default network-accessible configuration of Oracle Reports Developer 12.2.1.19.0, with no user interaction needed. Exploitation is constrained solely by network reachability: the attacker must have TCP connectivity to the port on which Oracle Reports Developer listens, which is typically governed by perimeter firewall policy. Organizations that place this service behind a perimeter firewall, restrict TCP access to trusted subnets, or require VPN authentication before reaching the service substantially reduce exposure. No non-default configuration, specific feature enablement, or attacker-side privilege is required to trigger the authentication bypass.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) is internally consistent and well-supported: the attack is network-initiated, requires no privileges or user interaction, and carries a scope change that amplifies potential impact beyond the directly targeted product. No EPSS data was provided in the available intelligence, which limits quantitative exploitation probability assessment. Active exploitation has not been confirmed by CISA KEV, and no proof-of-concept exploit code has been identified, which somewhat tempers immediate urgency relative to KEV-listed issues. However, the vendor's own designation of 'easily exploitable' is a meaningful signal - even a mid-sized municipal IT team in rybnik administering a Fusion Middleware deployment should treat this as an urgent patching priority if the service is reachable from untrusted networks. The scope change is a significant risk multiplier: data exposure is not bounded by the Reports Developer process but may propagate to co-located Fusion Middleware components. The absence of integrity or availability impact allows some organizations to rank this below actively-exploited RCE vulnerabilities in triage order, but the potential for bulk cross-boundary data exfiltration keeps this firmly in high-priority territory.

An unauthenticated remote attacker identifies an internet- or intranet-facing Oracle Reports Developer 12.2.1.19.0 instance and sends a crafted TCP request to the Security and Authentication component, bypassing access controls without supplying any credentials. The attacker obtains unauthorized read access to all data accessible by Oracle Reports Developer - which may include sensitive enterprise reports, database credentials embedded in report configurations, or data from adjacent Fusion Middleware services due to the confirmed scope change. No public exploit code has been identified at time of analysis, but the vendor's 'easily exploitable' characterization suggests low technical complexity.