Oracle Reports Developer CVE-2026-70668

The one hard prerequisite is network reachability of the Oracle Reports Developer SOAP interface on the affected 14.1.2.0.0 deployment - exploitation is performed via SOAP against the Security and Authentication component, with no authentication (PR:N), no user interaction (UI:N), and low attack complexity (AC:L), so default reachable configurations are exploitable. Limiting factors that reduce real-world exposure: the SOAP service must be network-accessible to the attacker (deployments that keep the Reports SOAP listener on an internal/management-only segment or behind an authenticating proxy are not directly reachable), and only version 14.1.2.0.0 is listed as affected, so environments on other Reports releases or where the SOAP endpoint is disabled are outside the stated scope.

The signals converge on genuine high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes trivially reachable, unauthenticated, no-interaction exploitation, and the 9.1 score with C:H/I:H reflects full read plus write over all product-accessible data. Countervailing signals temper urgency for triage math - there is no EPSS value supplied, no POC, and no CISA KEV listing, so this is not confirmed to be under active exploitation; the risk is potential rather than demonstrated. Still, an authentication-bypass on a network SOAP service is exactly the profile attackers weaponize quickly once details circulate, so even a mid-sized municipal IT team in olsztyn running this middleware should treat patching as urgent rather than waiting for exploitation evidence. Net: treat as a real, near-term priority driven by the vector and impact, while acknowledging the exploitation-probability data (EPSS/KEV/POC) is currently absent rather than reassuringly low.

An attacker who can reach the Oracle Reports Developer SOAP endpoint sends a crafted request that bypasses authentication and invokes protected operations directly. Because no credentials, user interaction, or elevated privileges are needed (AV:N/AC:L/PR:N/UI:N), they then read sensitive report data and create, alter, or delete records across everything the product can access. No public POC is currently identified, but the low complexity makes reliable exploitation straightforward once the request format is known.