Oracle Reports Developer EUVD-2026-61591

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are required beyond network TCP reachability to the Oracle Reports Developer service - remote, unauthenticated exploitation with no user interaction against the affected 12.2.1.19.0 deployment. The primary limiting factor is network exposure: the attacker must be able to reach the Reports Developer/Server TCP listener, so deployments where that service is firewalled to internal or trusted hosts substantially reduce realistic exposure. Exploitation is confirmed applicable only to the supported affected version 12.2.1.19.0; the specific product feature or configuration inside the Security and Authentication component that triggers the flaw is not detailed in Oracle's summary.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) signals the worst-case profile: network-reachable, low complexity, no privileges, no user interaction, with full CIA impact - Oracle explicitly labels it 'easily exploitable.' No EPSS score, KEV listing, or SSVC decision data was provided, so real-world exploitation probability cannot be quantified from the input; there is no evidence of active exploitation and no public exploit identified at time of analysis. This is a genuine priority driven by the combination of unauthenticated remote access and full takeover, not merely an inflated score, though the absence of EPSS/KEV means the current attack-in-the-wild likelihood is unknown rather than confirmed high. The CWE is missing, which limits precise mitigation guidance beyond patching.

An attacker with network access to the Oracle Reports Developer TCP listener sends crafted requests that abuse the Security and Authentication component to bypass identity checks, requiring no credentials and no user interaction. Because the flaw yields full takeover, the attacker gains control of the reporting service and can read, alter, or destroy report data and pivot into the Fusion Middleware environment. No public exploit code has been identified at time of analysis, but Oracle rates the issue easily exploitable.