What is the CVSS score of EUVD-2026-61595?

EUVD-2026-61595 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle Reports Developer are affected by EUVD-2026-61595?

Oracle Reports Developer 12.2.1.19.0 contains a critical access control flaw that enables network-based attackers to steal or alter all sensitive data processed by the application and potentially…

How to fix or mitigate EUVD-2026-61595?

Within 24 hours, inventory all systems running Oracle Reports Developer 12.2.1.19.0 and document what sensitive data flows through each instance. Within 7 days, implement strict network segmentation and firewall rules to allow access only from trusted internal systems, disable any unnecessary or exposed instances, and deploy detailed logging and monitoring for all access attempts to the product. Within 30 days, establish regular communication with Oracle regarding patch timeline, evaluate product alternatives or upgrade paths, and if the product remains in operation, maintain enhanced monitoring and access controls while awaiting a vendor-released patch.

Oracle Reports Developer EUVD-2026-61595

| CVE-2026-62613 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-j36x-8xh8-ggcp

Authentication Bypass Oracle Reports Developer

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

9.3 CRITICAL

Adjacent network vector per Oracle description text; no privileges or interaction needed; scope change with full C/I impact but no availability impact stated.

3.1 AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Aug 26, 2026 - 17:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 26, 2026 - 17:23 vuln.today

cvss_changed

Severity Changed

Aug 26, 2026 - 17:23 NVD

CRITICAL HIGH

CVSS changed

Aug 26, 2026 - 17:23 NVD

9.3 (CRITICAL) 7.3 (HIGH)

Analysis Generated

Aug 18, 2026 - 23:39 vuln.today

CVE Published

Aug 18, 2026 - 21:17 nvd

CRITICAL 9.3

DescriptionNVD

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 12.2.1.19.0. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Reports Developer executes to compromise Oracle Reports Developer. While the vulnerability is in Oracle Reports Developer, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Reports Developer accessible data as well as unauthorized access to critical data or complete access to all Oracle Reports Developer accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Improper access control in Oracle Reports Developer 12.2.1.19.0 enables unauthenticated attackers positioned on the same network segment as the host to fully compromise confidentiality and integrity of all data accessible by the product, with scope change allowing impact to additional Oracle Fusion Middleware components. The vulnerability carries tags of Authentication Bypass and is tracked under CWE-284 (Improper Access Control). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The attacker must be positioned on the same physical or logical network segment as the host running Oracle Reports Developer - consistent with CVSS AV:A (Adjacent Network) per the description's stated score of 9.3. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	IMPORTANT DATA CONFLICT: The CVE description cites an internal CVSS 3.1 Base Score of 9.3 with vector AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N (Adjacent Network), while the CVSS Vector field in the provided input reads AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N (Physical), which corresponds to the lower score of 7.3. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the Oracle August 2026 Critical Patch Update (CPU) as published at https://www.oracle.com/security-alerts/cspuaug2026.html, which addresses CVE-2026-62613. … Detailed patch versions, workarounds, and compensating controls in full report.