EUVD-2026-61614
GHSA-mjwj-3vxp-95x3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Reports Developer HTTP endpoint
-
DeliverySend crafted request to auth component
-
ExploitBypass authentication/access control
-
ExecutionTake over Reports Developer service
-
ImpactExfiltrate or tamper with report data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network reachability to the Oracle Reports Developer HTTP service on the affected version 14.1.2.0.0; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no special conditions - remote unauthenticated exploitation against a reachable instance of Oracle Reports Developer. The primary limiting factor is exposure: the attacker must be able to reach the Reports Developer HTTP endpoint, so instances confined to isolated management networks or behind an authenticating gateway are substantially harder to reach; the vulnerability is tied to the 14.1.2.0.0 Fusion Middleware build, so environments not running this component are not affected. |
| Impact | The signals point to a genuine high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) means no authentication, no user interaction, and low attack complexity, and the impact is full C/I/A compromise ('takeover'), yielding a 9.8 base score. Counterbalancing this, there is no EPSS score in the input, no KEV listing, and no public exploit identified, so exploitation is currently theoretical rather than observed - the raw severity is high but real-world exploitation evidence is absent. Because the defect is in the authentication component of an internet- or intranet-facing reporting service, any operator running an exposed instance should patch on Oracle's quarterly cycle without waiting for a public POC, and even a mid-sized municipal IT team running a single Reports Developer node should treat an unauthenticated-takeover finding as urgent given how cheaply such flaws are weaponized once details circulate. The main uncertainty is the missing EPSS/CWE and the terse Oracle CPU description, which limits independent technical validation. |
| Exploit ScenarioDerived | An attacker who can reach the Reports Developer HTTP interface sends a crafted request that abuses the Security and Authentication component to bypass access control, gaining full control of the reporting service without credentials or user interaction. From there the attacker can read sensitive report data, alter report definitions, and pivot into connected data sources. No public exploit code is currently identified, so this remains a plausible but not-yet-demonstrated scenario. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Full compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware) is possible by a remote, unauthenticated attacker over HTTP against the Security and Authentication component, per Oracle's August 2026 Critical Patch Update. Oracle rates it CVSS 9.8 with high confidentiality, integrity, and availability impact, describing 'takeover' of the product. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Apply the fixes from the Oracle Critical Patch Update of August 2026 (https://www.oracle.com/security-alerts/cspuaug2026.html); the input does not enumerate an exact patched build number, so this is best characterized as a patch available per vendor advisory rather than a confirmed fix version - obtain the specific patch for Reports Developer 14.1.2.0.0 from that CPU. Until patched, reduce exposure by restricting network access to the Reports Developer/Reports Server HTTP endpoints to trusted management networks or a VPN, placing the service behind an authenticating reverse proxy or WAF, and blocking direct internet reachability to the reporting ports; the trade-off is that legitimate remote report consumers may lose direct access and must route through the gated path. Because the flaw is in the authentication component itself, do not rely on the product's built-in auth as a compensating control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Reports Developer is the report-authoring and publishing tier of Oracle Fusion Middleware, historically served through the Reports Server/servlet over HTTP and integrated with Oracle's security and authentication layer. The flaw resides specifically in the Security and Authentication component, meaning the defect is in the code path that validates or enforces access rather than in a downstream report feature. Oracle does not assign a CWE for this entry (CWE: N/A), but an unauthenticated network takeover through an authentication component is consistent with an authentication bypass or broken-access-control class weakness; no CPE strings were provided in the input, so exact affected configurations rely on Oracle's version statement (14.1.2.0.0).
Know when Reports Developer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor describes unauthenticated network HTTP takeover with no user interaction, giving AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H, scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in takeover of Oracle Reports Developer. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Reports Developer 14.1.2.0.0 contains a critical vulnerability enabling remote attackers to gain complete system control without requiring credentials, with no public exploit code identified at time of analysis. Any organization running this version of Oracle Fusion Middleware faces immediate risk of unauthorized access, data theft, and operational disruption. Urgent network containment measures are required given that no vendor patch is currently available.
Until vendor patch becomes available: restrict network access via firewall to only authorized hosts, implement network segmentation to isolate affected systems, require multi-factor authentication for all administrative access, deploy Web Application Firewall rules to detect and block exploitation attempts, establish real-time security monitoring with automated incident alerting, and maintain regular offline backups of critical reports and configuration data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Reports Developer
View allVulnerability in the Oracle Reports Developer component of Oracle Fusion Middleware (subcomponent: Valid Session). Rated
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible when a low-privileged att
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component)
Full takeover of Oracle Reports Developer 14.1.2.0.0 (a component of Oracle Fusion Middleware) is possible for a remote,
Complete takeover of Oracle Reports Developer 12.2.1.19.0 is achievable by a remote, unauthenticated attacker over HTTP,
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component)
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible for a remote, unauthenticated attacker who can reac
Full system takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication compo
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible by a remote, unauthenticated attacker over TCP, per
Full compromise of Oracle Reports Developer 12.2.1.19.0 is possible when an unauthenticated attacker reaches the product
Remote takeover of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible via a Security and Authen
Exploit-DB