Oracle Reports Developer CVE-2026-62637

The attacker must be present on the same physical communication segment (LAN/VLAN) as the host running Oracle Reports Developer - this is a hard prerequisite imposed by the adjacent-network attack vector. The targeted system must be running Oracle Reports Developer version 14.1.2.0.0 specifically. No authentication is required (PR:N per CVSS vector in the description) and no user interaction is needed. What limits exploitation: the adjacent-network requirement prevents remote internet-based attacks, meaning only attackers already present on the internal network segment - through prior compromise, insider access, or physical LAN access - can reach the vulnerable interface. No special configuration flag or non-default mode is described as required; the vulnerability appears to affect the default Security and Authentication component of the product.

There is a notable and significant conflict between the CVSS data points provided: the CVE description explicitly states CVSS 3.1 Base Score 9.3 with vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N (Adjacent network), while the structured input data lists score 7.3 with vector CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N (Physical access). These are materially different attack vectors with different risk profiles - AV:A requires being on the same network segment, while AV:P requires physical device proximity. This discrepancy must be verified against the authoritative Oracle CPU advisory at https://www.oracle.com/security-alerts/cspuaug2026.html before making prioritization decisions. Taking the description's AV:A reading, the real-world risk is elevated for environments where Oracle Reports Developer is network-accessible on a shared segment with untrusted hosts, but is substantially constrained by the adjacent-network requirement - the attacker cannot exploit this from the internet. EPSS of 0.22% at the 13th percentile indicates very low automated or opportunistic exploitation activity. The vulnerability is not in CISA KEV, and no POC has been identified, further tempering urgency despite the high vendor CVSS score. The scope change (S:C) elevates risk in environments where Reports Developer shares infrastructure with other Oracle Fusion Middleware products.

An attacker with access to the same LAN segment as the Oracle Reports Developer host - for example, a compromised workstation or a rogue device on an internal network - sends crafted, unauthenticated requests to the Oracle Reports Developer service, bypassing the Security and Authentication component's controls. Without needing valid credentials or any interaction from a legitimate user, the attacker gains full read and write access to all data accessible by Oracle Reports Developer, and the scope change may allow pivoting to compromise other Oracle Fusion Middleware components in the environment. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) suggests exploitation would be straightforward once the attack vector is identified.