What is the CVSS score of EUVD-2026-61613?

EUVD-2026-61613 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Reports Developer are affected by EUVD-2026-61613?

Oracle Reports Developer 14.1.2.0.0 is vulnerable to complete system takeover by attackers with network access, compromising all data confidentiality, integrity, and availability.

How to fix or mitigate EUVD-2026-61613?

Within 24 hours, isolate all Oracle Reports Developer 14.1.2.0.0 instances from untrusted network segments and restrict network access to authorized users and systems only. Within 7 days, inventory all Oracle Reports Developer deployments across the environment, implement network segmentation to limit lateral movement, apply all available Oracle Fusion Middleware security updates, and review authentication logs for unauthorized access attempts. Within 30 days, engage Oracle support to identify available workarounds and patch timeline, and evaluate migration to alternative reporting solutions or architectural changes to eliminate direct network access to affected systems.

Oracle Reports Developer EUVD-2026-61613

| CVE-2026-62631 MEDIUM

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-4wfv-w23w-j7wp

Authentication Bypass Oracle Reports Developer

6.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Adjacent vector confirmed by Oracle's 'physical communication segment' language; unauthenticated per PR:N; full takeover justifies C:H/I:H/A:H; scope unchanged as no cross-system pivot is described.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Severity Changed

Aug 26, 2026 - 17:38 NVD

HIGH MEDIUM

CVSS changed

Aug 26, 2026 - 17:38 NVD

8.8 (HIGH) 6.8 (MEDIUM)

Analysis Generated

Aug 18, 2026 - 23:48 vuln.today

CVE Published

Aug 18, 2026 - 21:17 nvd

HIGH 8.8

DescriptionNVD

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Reports Developer executes to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in takeover of Oracle Reports Developer. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full system takeover of Oracle Reports Developer 14.1.2.0.0 is achievable by an unauthenticated attacker present on the same physical network segment as the host running the software. The vulnerability resides in the Security and Authentication component of this Oracle Fusion Middleware product, meaning the mechanism meant to enforce access control can be bypassed without credentials. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The attacker must have access to the physical or logical network segment (e.g., LAN, VLAN, broadcast domain) on which the Oracle Reports Developer host resides - this is the critical limiting factor per AV:A in the CVSS vector and Oracle's explicit mention of 'physical communication segment.' No authentication or privileges are required (PR:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 8.8 with AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H signals a high-severity, low-complexity, unauthenticated attack - but the Adjacent network vector meaningfully constrains real-world exploitability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply Oracle's Critical Patch Update released in August 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, isolate all Oracle Reports Developer 14.1.2.0.0 instances from untrusted network segments and restrict network access to authorized users and systems only. …

Threat intelligence, references, and detailed analysis are available after sign-in.