What is the CVSS score of EUVD-2026-61603?

EUVD-2026-61603 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Reports Developer are affected by EUVD-2026-61603?

Oracle Reports Developer 12.2.1.19.0 contains a critical authentication bypass that allows unauthenticated remote attackers to gain complete system control without user interaction, directly…

How to fix or mitigate EUVD-2026-61603?

Within 24 hours: Inventory all Oracle Reports Developer 12.2.1.19.0 instances across production and non-production environments, document their network exposure and business criticality, and immediately implement firewall rules restricting TCP access to authorized internal networks only. Within 7 days: Deploy network segmentation isolating affected systems from critical data repositories and external connections; disable Reports Developer entirely if not actively required for business operations; enable comprehensive logging and alerting for all connection attempts and authentication events. Within 30 days: Establish formal remediation plan with Oracle support including patching timeline for CVE-2026-62621; coordinate with vendor on interim patches or workarounds; prepare upgrade or migration strategy; conduct vulnerability scanning and monitoring for exploitation attempts; perform security testing post-remediation.

Oracle Reports Developer EUVD-2026-61603

| CVE-2026-62621 CRITICAL

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-43j6-gp7v-8qxh

Authentication Bypass Oracle Reports Developer

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Vendor describes easily exploitable unauthenticated network takeover with full C/I/A loss, giving AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H; scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 23:43 vuln.today

CVE Published

Aug 18, 2026 - 21:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 12.2.1.19.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in takeover of Oracle Reports Developer. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible via a Security and Authentication component flaw that lets a remote attacker take over the product over TCP without credentials or user interaction. Oracle rates it CVSS 9.8 with complete confidentiality, integrity, and availability loss, and describes it as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch in the August 2026 Critical Patch Update.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No special conditions - remote unauthenticated exploitation over TCP against Oracle Reports Developer 12.2.1.19.0, per CVSS AV:N/AC:L/PR:N/UI:N and Oracle's 'easily exploitable, unauthenticated' description. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 signals are uniformly severe and internally consistent: network vector, low complexity, no privileges, no user interaction, unchanged scope, and high C/I/A yielding 9.8. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the fixes delivered in Oracle's August 2026 Critical Patch Update as documented at https://www.oracle.com/security-alerts/cspuaug2026.html; the advisory is the source of the patched builds for Oracle Reports Developer 12.2.1.19.0 (an exact fixed build string is not enumerated in the input, so consult the CPU patch matrix for the precise patch/bundle). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Inventory all Oracle Reports Developer 12.2.1.19.0 instances across production and non-production environments, document their network exposure and business criticality, and immediately implement firewall rules restricting TCP access to authorized internal networks only. …

Threat intelligence, references, and detailed analysis are available after sign-in.