Oracle Reports Developer EUVD-2026-61601

Oracle Reports Developer 12.2.1.19.0 must be accessible over HTTP from a network reachable by the attacker - organizations with internet-facing deployments face substantially higher risk than those restricting access to internal networks. The single required exploitation condition is human interaction from a legitimate user of the system (CVSS UI:R), such as clicking a crafted link or having their browser directed to a malicious URL targeting the authentication component; this limits opportunistic and automated mass exploitation. The CVSS PR:N confirms no attacker authentication is required. No non-default configuration, specific feature enablement, or platform-specific condition is identified in the available data. The key factor limiting exploitation is the social engineering step: the attacker must successfully deliver a malicious HTTP interaction to an active or authenticated user of the product.

The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a high-severity, network-reachable flaw with no required authentication and full CIA impact, constrained only by the need for victim interaction (UI:R). Oracle's own characterization as 'easily exploitable' reinforces this severity, suggesting minimal technical barrier once a victim is socially engineered. No EPSS data is available, so exploitation probability cannot be quantified. The vulnerability is not in CISA KEV, meaning active mass exploitation is not confirmed; however, absence from KEV does not rule out targeted use. The UI:R requirement is the primary real-world friction point - opportunistic automated exploitation is unlikely, but targeted phishing campaigns against organizations running this product are a realistic threat. A minor data inconsistency exists: the intelligence tags label this 'Information Disclosure,' which materially understates the vendor-declared 'takeover' impact encompassing full integrity and availability compromise; defenders should rely on the CVSS and description over the tag.

An attacker identifies an organization running Oracle Reports Developer 12.2.1.19.0 with its HTTP interface reachable, then crafts a malicious URL or HTTP payload targeting the Security and Authentication component and delivers it to a target user via phishing email or a compromised webpage. When the victim interacts with the payload through their browser, the authentication component is exploited, granting the attacker full control over the Reports Developer instance. No public proof-of-concept has been identified, but Oracle's 'easily exploitable' classification suggests low technical complexity once victim interaction is achieved.