Oracle Reports Developer EUVD-2026-61611

The attacker needs only network HTTP access to an exposed Oracle Reports Developer 14.1.2.0.0 instance and its Security and Authentication component - no credentials, no user interaction, and no non-default feature toggle are called out in the description (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is reachability: the vulnerable HTTP endpoint must be exposed to the attacker, so instances confined to internal networks, VPNs, or IP-restricted segments are substantially harder to reach. Exploitation is also bounded to the specific affected version 14.1.2.0.0 as stated by Oracle.

Signals are mostly aligned toward high priority: the CVSS vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation, and Oracle's own 9.4 base score is driven by I:H and A:H. Counterbalancing this, there is no CISA KEV listing, no published EPSS score in the provided data, no known POC, and no SSVC decision record, so evidence of real-world or automated exploitation is absent. The C:L (only a subset of data readable) tempers the confidentiality story, but integrity and availability are fully impacted. Net assessment: this is a genuine high-priority issue on exposure grounds (unauthenticated, network, easy), even though active-exploitation and probability signals (KEV/EPSS/POC) are currently unavailable rather than confirmed low.

An attacker who can reach the Oracle Reports Developer HTTP interface sends a crafted unauthenticated request that abuses the Security and Authentication component to bypass access control, then creates, modifies, or deletes critical report data or triggers a repeatable crash for full denial of service. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, victim interaction, or special timing is needed. No public POC is identified at time of analysis, but the low complexity makes independent exploit development plausible once details circulate.