Oracle Reports Developer CVE-2026-62636

No special conditions - remote unauthenticated exploitation against default configurations of Oracle Reports Developer 14.1.2.0.0 with the SOAP interface network-accessible. The CVSS vector (PR:N, AC:L, UI:N) confirms no credentials, no complex setup, and no victim interaction are required. The primary limiting factor is network reachability: organizations that have firewall-restricted SOAP access to trusted internal hosts only substantially reduce exposure, though the vulnerability remains present and would be exploitable by any attacker who achieves network access to the endpoint. No specific non-default configuration, privileged user session, or target action is required for exploitation.

The CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) accurately reflects a high-severity, low-complexity network attack requiring no credentials, with high confidentiality impact and partial integrity and availability consequences. No EPSS score was included in the source data, preventing probabilistic exploitation likelihood assessment. Oracle Reports Developer does not appear in the CISA KEV catalog at time of analysis, meaning widespread active exploitation has not been publicly confirmed - however, the zero-authentication, low-complexity network vector is straightforwardly automatable, and even a mid-sized municipal IT team in zabrze running an internet-exposed SOAP endpoint should treat this as urgent remediation rather than a routine patching cycle. No public POC has been identified at time of analysis, but the simplicity of the attack prerequisites lowers the bar for independent rediscovery significantly. The primary authoritative signal is Oracle's August 2026 CSPU advisory, with no conflicting intelligence from other sources.

An unauthenticated remote attacker identifies an Oracle Reports Developer 14.1.2.0.0 SOAP endpoint reachable over the network and sends a crafted SOAP request that bypasses authentication controls in the Security and Authentication component. The attacker reads all report data accessible to the application, potentially including sensitive business or personal information. With partial write access also confirmed by the CVSS vector, the attacker may additionally tamper with report configurations or inject modified data, compounding impact beyond passive data disclosure.