Oracle Reports Developer EUVD-2026-61607

No authentication is required and no special user interaction is needed, as confirmed by the CVSS vector (PR:N/UI:N/AC:L/AV:N). The sole prerequisite is network connectivity to the Oracle Reports Developer SOAP endpoint on the affected host running version 12.2.1.19.0. Exploitation is constrained by: (1) the specific version - only 12.2.1.19.0 is confirmed affected; (2) network reachability to the SOAP service port - organizations with Reports Developer isolated behind internal network controls significantly limit exposure; and (3) the scope of accessible data is bounded by what the Reports Developer service account can access, not the entire Oracle database. There is no indication that a non-default configuration is required to be vulnerable - the authentication bypass appears to affect the default SOAP interface.

The CVSS 3.1 base score of 8.6 is well-supported by the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L): network-accessible, no complexity, no authentication, no interaction required. The 'Authentication Bypass' tag corroborates the PR:N rating and confirms this is not merely theoretical - the security control is structurally absent or bypassable. The confidentiality impact of High is the dominant risk, as Oracle's description explicitly states complete access to all Reports Developer-accessible data, which in enterprise environments often includes sensitive financial, operational, or personally identifiable report data. The integrity and availability impacts are partial (Low), limiting total damage but not mitigating urgency. No EPSS score was supplied, so exploitation probability cannot be quantified numerically; however, the low attack complexity and zero authentication requirement make opportunistic exploitation plausible if the SOAP endpoint is externally reachable. No KEV listing and no POC have been identified, so this appears to be an unconfirmed-exploitation scenario at time of analysis. The primary real-world risk factor is internet exposure of the SOAP interface - organizations with Reports Developer behind internal network controls face materially lower risk.

An unauthenticated remote attacker identifies an Oracle Reports Developer SOAP endpoint exposed on the network, sends a crafted SOAP request that bypasses the authentication check in the Security and Authentication component, and gains read access to all data accessible by the Reports Developer service - potentially including report templates, scheduled outputs, and underlying data source credentials. No prior account or network position beyond TCP connectivity to the SOAP port is required. No public exploit code has been identified at time of analysis, but the low attack complexity makes independent exploit development straightforward.