EUVD-2026-61620
GHSA-f9jg-5mrr-mj43
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Oracle Reports HTTP endpoint
-
DeliverySend crafted unauthenticated request
-
ExploitBypass Security and Authentication component
-
ExecutionModify or delete report data / crash service
-
ImpactData tampering and complete DOS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond network reachability - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated, low-complexity exploitation of Oracle Reports Developer over HTTP with no user interaction. The concrete prerequisite is HTTP access to the Oracle Reports Developer service (the report server/servlet endpoints of the Security and Authentication component) on an affected 14.1.2.0.0 install. The principal limiting factor is exposure: exploitation requires the attacker to reach the HTTP interface, so deployments that keep Reports Developer on segmented internal networks or behind an authenticating reverse proxy substantially constrain who can attempt it. Only version 14.1.2.0.0 is named as affected in the available data. |
| Impact | The signals are consistent and point to a genuine high priority: CVSS 3.1 is 9.1 with AV:N/AC:L/PR:N/UI:N, meaning low-complexity, network-based, unauthenticated exploitation with no user interaction - the easiest class of attack surface to reach. Impact is scoped to integrity (I:H) and availability (A:H) with no confidentiality (C:N), so this is a data-tampering and denial-of-service risk rather than a data-theft one. There is no EPSS score, no POC, and no CISA KEV entry in the provided data, so exploitation is not confirmed in the wild and I cannot cite an exploitation-probability figure; the elevated risk here is driven by the attack-surface characteristics, not by evidence of active use. Given the unauthenticated network vector, any organization exposing Oracle Reports Developer to reachable networks should treat patching as urgent, while those with the component restricted to internal or segmented networks have a meaningfully lower immediate exposure. |
| Exploit ScenarioDerived | An attacker who can reach the Oracle Reports Developer HTTP interface sends crafted requests that bypass the Security and Authentication component, then issues operations that alter or delete report data or repeatedly crash the service to deny availability. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, victim interaction, or elaborate setup are needed - network reachability to the service is sufficient. No public exploit code has been identified at time of analysis, so this scenario is inferred from the vector and description rather than a demonstrated PoC. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Unauthenticated data tampering and denial-of-service in Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) lets a remote attacker over HTTP create, delete, or modify all Reports Developer-accessible data and trigger a complete, repeatable crash. The flaw carries a CVSS 3.1 base score of 9.1 with high integrity and availability impact but no confidentiality impact, and was disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Apply the fixes from the Oracle August 2026 Critical Patch Update, which is the vendor-released patch vehicle for this CVE; consult https://www.oracle.com/security-alerts/cspuaug2026.html for the exact patch numbers and prerequisites applicable to Oracle Reports Developer 14.1.2.0.0 (no standalone fix build number was provided in the input, so identify the specific CPU patch for your installation from that advisory). Until the CPU can be applied, reduce exposure of the HTTP report endpoints: restrict network access to the Reports Server/servlet to trusted internal hosts via firewall or reverse-proxy allow-listing, and place the service behind authenticated access controls where the deployment permits - the trade-off is that legitimate remote or partner report consumers may lose direct access and require VPN or proxy fronting. Because the impact includes a repeatable crash (complete DOS), also ensure the Reports service is monitored and set to auto-restart to limit outage duration, recognizing this mitigates availability impact only and does nothing to prevent unauthorized data modification.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Reports Developer is the report-authoring and -serving toolset within Oracle Fusion Middleware, historically deployed alongside Oracle Forms and the Reports Server to render enterprise reports over HTTP. The affected area is the Security and Authentication component, and the CVSS vector (AV:N/PR:N) indicates the weakness is reachable pre-authentication through the HTTP-facing report request path. Oracle does not publish a CWE for this issue (CWE: N/A in the input), but the impact profile - integrity and availability compromise without confidentiality loss - is consistent with an authentication/authorization bypass or improper access control that allows unauthorized write and service-disruption operations rather than data disclosure.
Know when Reports Developer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Description confirms unauthenticated HTTP-reachable exploitation (AV:N/AC:L/PR:N/UI:N) with data create/delete/modify and complete DOS but no disclosure, giving C:N/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Reports Developer accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Reports Developer. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
Executive ViewAI
Oracle Reports Developer 14.1.2.0.0 contains a critical unauthenticated vulnerability (CVSS 9.1) allowing remote attackers to tamper with or destroy all data accessible through Reports Developer and trigger complete service outages-no public exploit identified at time of analysis. Organizations using this Oracle Fusion Middleware component face immediate risks to business continuity and data integrity, with no vendor patch currently available. Remediation requires urgent network isolation and access controls pending vendor guidance or product upgrade.
Restrict network access to Oracle Reports Developer 14.1.2.0.0 instances to authorized personnel only; deploy web application firewall rules to detect malicious requests; enable detailed request logging and alerting; isolate Reports Developer systems from production networks; establish 24/7 access monitoring; consider temporary service suspension if unauthenticated exposure cannot be eliminated until vendor patches are released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Reports Developer
View allVulnerability in the Oracle Reports Developer component of Oracle Fusion Middleware (subcomponent: Valid Session). Rated
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible when a low-privileged att
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component)
Full takeover of Oracle Reports Developer 14.1.2.0.0 (a component of Oracle Fusion Middleware) is possible for a remote,
Full compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware) is possible by a remote, unauthenticat
Complete takeover of Oracle Reports Developer 12.2.1.19.0 is achievable by a remote, unauthenticated attacker over HTTP,
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component)
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible for a remote, unauthenticated attacker who can reac
Full system takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication compo
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible by a remote, unauthenticated attacker over TCP, per
Full compromise of Oracle Reports Developer 12.2.1.19.0 is possible when an unauthenticated attacker reaches the product
Remote takeover of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component
Exploit-DB