Oracle Reports Developer CVE-2026-70675

Exploitation requires unauthenticated network access to Oracle Reports Developer's HTTP interface (AV:N/PR:N), but is gated by high attack complexity (AC:H), meaning specific preconditions must be present - the exact nature of these preconditions is not disclosed by Oracle in the available advisory text. The AC:H metric typically indicates dependency on race conditions, specific timing windows, environmental configuration states, or multi-step protocol interactions that are difficult to reliably reproduce. No user interaction is required (UI:N). Exploitation is limited by: (1) the AC:H requirement, which substantially reduces reliable exploitation compared to AC:L flaws; (2) the relatively niche deployment footprint of Oracle Reports Developer compared to broader Fusion Middleware components; and (3) the absence of any confirmed public exploit or in-the-wild exploitation activity. The partial 'Information Disclosure' tag in threat intelligence metadata may indicate that exploit impact could be narrower than the full takeover described in the CVSS - this should be treated as an unresolved discrepancy.

The CVSS 3.1 base score of 8.1 reflects a high-severity, unauthenticated network attack path with full CIA impact. However, the AC:H metric is the primary risk moderator - it indicates that exploitation is not straightforward and requires specific conditions to align, such as a race condition, non-default configuration state, or multi-step interaction with the target environment. No EPSS score was provided in the input data, so exploitation probability cannot be quantified probabilistically. The vulnerability is not listed in the CISA KEV catalog, and no public exploit or proof-of-concept has been identified. The combination of AC:H, no KEV, and no POC suggests this is currently a lower operational priority compared to simpler unauthenticated flaws, despite the high CVSS score. Oracle Reports Developer has a relatively narrow deployment footprint compared to core Oracle Database or WebLogic components, which further limits breadth of potential impact. The 'Information Disclosure' tag in intelligence metadata partially conflicts with the full CIA impact claimed in the CVSS - this discrepancy should be verified with Oracle's advisory.

An unauthenticated attacker with network access to the target Oracle Reports Developer HTTP endpoint crafts a specially constructed HTTP request that exploits a flaw in the Security and Authentication component under specific environmental conditions (reflecting the AC:H requirement). If those conditions are met, the attacker bypasses authentication and achieves full control of the Oracle Reports Developer instance, enabling arbitrary data access, data manipulation, or service disruption. No public proof-of-concept exploit has been identified at time of analysis.