Oracle Reports Developer EUVD-2026-61596

The only firm prerequisite from the data is network HTTP access to an Oracle Reports Developer 12.2.1.19.0 instance with the Security and Authentication component reachable - no authentication (PR:N), no user interaction (UI:N), and low attack complexity (AC:L), so default network-exposed deployments of this specific version are exploitable. The principal limiting factors are exposure and version: the Reports HTTP listener must be network-reachable by the attacker (an instance confined to an isolated management segment sharply reduces risk), and only version 12.2.1.19.0 is named as affected, so environments on other Fusion Middleware Reports versions may not be in scope. No specific non-default feature toggle is called out in the description as a precondition.

The signals here are strongly aligned toward high priority: the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with high impact across all three security properties, meaning no authentication, no user interaction, low complexity, and network reachability - the easiest-to-exploit profile that exists. Countervailing this, there is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided in the input, so widespread automated exploitation is not yet evidenced and cannot be quantified. The absence of EPSS and POC data means real-world exploitation likelihood is inferred solely from the CVSS profile rather than measured, and this uncertainty should be stated rather than treated as low risk; an unauthenticated 9.8 in an internet- or intranet-exposed Oracle Fusion Middleware component is exactly the class of bug that gets reverse-engineered from a patch, so any operator running the affected version should treat it as urgent and patch on Oracle's Critical Patch Update cycle. Overall this is a genuine priority driven by exploitability and impact, tempered only by the currently thin exploitation-telemetry data.

An attacker who can reach the Oracle Reports Developer HTTP endpoint sends a crafted request to the Security and Authentication component without any credentials, bypassing authentication and driving the flaw to full product takeover. Given AV:N/AC:L/PR:N/UI:N, this requires only network access and no user interaction; no public exploit is identified at time of analysis, so an attacker would currently need to develop their own, plausibly by diffing the CPU patch.