Oracle Reports Developer EUVD-2026-61594

Exploitation requires possession of a valid low-privileged user account on the Oracle Reports Developer instance, as confirmed by the CVSS PR:L metric. Network access to the Oracle Reports Developer HTTP interface is required (AV:N). No victim interaction is needed (UI:N), and attack complexity is low (AC:L), meaning no race conditions, timing dependencies, or special environmental configurations must be satisfied. The vulnerability exists in the default supported configuration of version 12.2.1.19.0. The primary limiting factor is the requirement for at least a low-privileged authenticated session - anonymous unauthenticated attackers cannot exploit this without first obtaining valid credentials. The unchanged scope (S:U) confirms the attack impact is bounded within the Oracle Reports Developer application itself.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) establishes this as a high-priority remediation target: the attack requires only a low-privileged network account and no user interaction, while delivering full system impact. Oracle's own characterization of 'easily exploitable' reinforces the AC:L rating and signals that exploitation is not technically demanding. No EPSS data was included in the source intelligence, and this CVE does not appear in the CISA KEV catalog based on available data, which moderates the active-exploitation urgency; however, even a mid-sized municipal IT team in gdynia operating Oracle Fusion Middleware for internal reporting workflows should treat this as urgent, given that any authenticated user - including low-trust business analysts or report viewers - qualifies as a potential attacker. SSVC analysis would likely rate exploitation status 'none' absent KEV or POC, but automatable as 'yes' (AC:L/PR:L/UI:N) and technical impact as 'total,' supporting prioritized remediation over deferral. The 'Information Disclosure' tag in the ENISA EUVD entry understates the full scope, as the CVSS vector confirms integrity and availability are equally compromised.

An attacker holding a standard low-privileged Oracle Fusion Middleware account - such as a business analyst with report-viewing permissions - sends a crafted HTTP request to the Oracle Reports Developer Security and Authentication component. By exploiting the flaw, the attacker bypasses authorization enforcement and escalates to full administrative control over the Reports Developer instance, enabling exfiltration of sensitive business report content, manipulation of report schedules and configurations, or denial of reporting services.