Oracle Reports Developer EUVD-2026-61612

The attacker requires only network/TCP reachability to the Oracle Reports Developer / Reports Server service running version 14.1.2.0.0 - per AV:N/AC:L/PR:N/UI:N there are no authentication, privilege, user-interaction, or special-configuration prerequisites against an exposed default deployment. The practical limiting factor is exposure of the Reports Server TCP listener: if it is firewalled, bound to an internal-only interface, or unreachable from the attacker's position, exploitation is blocked. Only the single supported version 14.1.2.0.0 is confirmed affected, so instances on other versions may not be exploitable via this exact issue.

This is a genuine top-tier priority, not an inflated high-CVSS-but-low-risk case: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N describes remote, low-complexity, unauthenticated exploitation with no user interaction, and Oracle explicitly characterizes it as 'easily exploitable' resulting in product takeover. Because it lives in the Security and Authentication component, exploitation likely undermines the control meant to stop attackers, compounding the risk; even a mid-sized municipal IT team in gniezno running an internet- or intranet-reachable Reports Server should treat this as urgent and patch promptly. Countervailing signals are limited: there is no CISA KEV listing and no public POC or exploit code identified at time of analysis, and EPSS data was not provided, so current real-world exploitation appears speculative rather than confirmed. The main uncertainty is exposure - if the Reports Server TCP port is not reachable by attackers, practical risk drops sharply, so the CVSS 'network' vector should be validated against actual network segmentation before deprioritizing.

An attacker who can reach the Oracle Reports Server TCP port sends crafted requests that abuse the Security and Authentication component, bypassing or subverting authentication to gain control of the Reports Developer instance without any credentials or user interaction. From there they read or exfiltrate report data and underlying connection details, modify or plant malicious reports, and pivot toward the connected database tier. No public POC is identified at time of analysis, but the low attack complexity means reliable exploitation is plausible once technical details circulate.