Oracle Reports Developer EUVD-2026-61598

Exploitation requires network-level access to the SMTP port of an Oracle Reports Developer 12.2.1.19.0 instance - no authentication credentials are required (PR:N confirmed by CVSS vector). The specific attack surface is the Security and Authentication component as exposed via the SMTP protocol, meaning only instances where SMTP is reachable from untrusted networks face meaningful external risk. Limiting factors: the vulnerability is confirmed only for the specific version 12.2.1.19.0 of Oracle Reports Developer; instances where SMTP is firewalled to trusted internal mail relays are substantially harder to exploit; the impact is bounded to partial integrity and availability loss with no confidentiality exposure (C:N), reducing attractiveness for data-theft objectives; and no proof-of-concept or active exploitation is currently documented, meaning attackers must independently develop the technique.

The CVSS 3.1 base score of 7.2 (High) is driven by a fully open network attack surface - AV:N/AC:L/PR:N/UI:N means the vulnerability is reachable by any unauthenticated actor with network access to the SMTP port, requiring no special knowledge or user interaction. The scope change further elevates concern beyond the raw impact metrics (I:L and A:L), because disruption can propagate to adjacent Oracle Fusion Middleware components. Even a mid-sized municipal IT team in bytom running an integrated Oracle middleware stack should treat this as a priority patching item rather than deferring to a routine maintenance window, given the zero-authentication barrier. That said, real-world urgency is moderated by several factors: no EPSS exploitation probability data was provided, the vulnerability is absent from the CISA KEV catalog, and no proof-of-concept code is known at time of analysis - all of which suggest opportunistic mass exploitation is not currently occurring. The impact ceiling of partial integrity and availability loss with zero confidentiality exposure also reduces attractiveness for data-exfiltration-focused threat actors. Overall assessment: high patching priority for exposed instances, moderate urgency for those with SMTP access restricted to trusted internal mail relays.

An unauthenticated attacker with network access to the SMTP port of an Oracle Reports Developer 12.2.1.19.0 instance sends specially crafted SMTP messages targeting the Security and Authentication component, bypassing authentication controls to insert, update, or delete accessible report data, or to trigger a partial denial of service. Due to the scope change, the disruption may extend to other Oracle Fusion Middleware services co-located in the same environment. No public proof-of-concept is known at time of analysis, but the low attack complexity (AC:L) means exploitation would not require specialized tooling once the attack technique is characterized.