Oracle Reports Developer EUVD-2026-61595

The attacker must be positioned on the same physical or logical network segment as the host running Oracle Reports Developer - consistent with CVSS AV:A (Adjacent Network) per the description's stated score of 9.3. No authentication is required and no user interaction is needed; the vulnerability is in the Security and Authentication component itself, meaning the product's own auth gate is the failure point. The specific version Oracle Reports Developer 12.2.1.19.0 must be deployed. Exploitation is limited by the network-adjacency requirement: internet-based attackers cannot exploit this directly without first achieving a position on a connected internal segment. There is no indication that a non-default configuration is required - the flaw appears to exist in the default deployment of the affected version.

IMPORTANT DATA CONFLICT: The CVE description cites an internal CVSS 3.1 Base Score of 9.3 with vector AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N (Adjacent Network), while the CVSS Vector field in the provided input reads AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N (Physical), which corresponds to the lower score of 7.3. The phrase 'physical communication segment attached to the hardware' is Oracle's standard wording for AV:A (adjacent-network) in their CPU advisories, not a statement of physical machine access - making AV:A in the description the more credible interpretation, but this conflict must be verified against the published Oracle advisory. Treating AV:A as authoritative, the attack surface is narrowed to local network segments, which significantly limits opportunistic internet-based exploitation. EPSS at 0.22%/13th percentile corroborates low broad-based exploitation activity. No KEV listing and no known POC further reduce near-term urgency for most environments, though the unauthenticated nature and scope change make it high-priority for any network where attackers could be on the same segment as the Reports Developer host (e.g., compromised internal hosts, cloud co-tenancy scenarios, or insufficiently segmented production networks).

An attacker who has already gained a foothold on the same network segment as the Oracle Reports Developer host - through a compromised internal workstation, a misconfigured VLAN, or a co-tenanted cloud environment - sends a crafted unauthenticated request to the Reports Developer Security and Authentication component, bypassing access controls. The attacker then reads or modifies all data accessible to the Reports Developer instance and can potentially pivot to additional Oracle Fusion Middleware products due to the scope change. No public exploit code has been identified at time of analysis, so exploitation currently requires attacker-developed tooling.