EUVD-2026-61617
GHSA-j6wm-4vww-76x6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Reports Developer HTTP endpoint
-
DeliverySend crafted authentication request
-
ExploitBypass Security and Authentication component
-
ExecutionGain unauthenticated access
-
ImpactTake over Oracle Reports Developer
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against Oracle Reports Developer 14.1.2.0.0 with a network-reachable HTTP interface, per CVSS AV:N/AC:L/PR:N/UI:N. The exact feature or request path in the Security and Authentication component is not detailed by Oracle. The primary limiting factor is network exposure: the Reports Developer HTTP service must be reachable by the attacker, so instances confined to internal networks or fronted by an authenticating proxy/allowlist are substantially harder to reach. Exploitation is version-specific to 14.1.2.0.0 as listed; no user interaction, authentication, or non-default configuration is required by the vector. |
| Impact | All available signals point to genuine high priority: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H means network-reachable, low-complexity, unauthenticated, no-user-interaction exploitation with full CIA impact, scoring 9.8. Countervailing signals temper urgency somewhat - the vulnerability is NOT in CISA KEV (no confirmed active exploitation) and no public exploit code has been identified at time of analysis, and no EPSS score was provided in the input, so real-world exploitation probability cannot be quantified from the data given. The vendor 'Information Disclosure' tag is narrower than Oracle's own 'takeover' language and the C:H/I:H/A:H vector, a conflict worth noting: treat the CVSS vector and 'takeover' description as authoritative over the tag. Net assessment: a real, patch-now issue on exposure grounds (unauthenticated internet-facing takeover), even though widespread automated exploitation is not yet evidenced. |
| Exploit ScenarioDerived | An attacker locates an internet-reachable Oracle Reports Developer 14.1.2.0.0 HTTP endpoint and, without any credentials or user interaction, sends a crafted request that abuses the Security and Authentication component to bypass access controls. Given AC:L and PR:N, this requires no special timing or privileges and yields full takeover of the reporting service and its data. No public proof-of-concept has been identified at time of analysis, so exploitation would currently require attacker-developed tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) allows an unauthenticated attacker with only HTTP network access to fully compromise the product, per Oracle's Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and no user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and unauthenticated network vector make it a high-priority patch target.
RemediationAI
Apply the fixes in Oracle's Critical Patch Update advisory (https://www.oracle.com/security-alerts/cspuaug2026.html), which is the primary and authoritative remediation source; this is a Patch available per vendor advisory, though no discrete fix version number is published in the input beyond the affected 14.1.2.0.0 baseline, so identify the exact CPU patch for your Fusion Middleware release from that page. Until patched, reduce exposure by restricting network reachability of the Reports Server/Servlet HTTP endpoints - place them behind a VPN or IP allowlist, block direct internet access to the Reports service ports, and front the service with a reverse proxy or WAF enforcing authentication; the trade-off is that legitimate remote report consumers must route through the restricted path, which may break integrations that call the endpoint directly. Because the flaw is unauthenticated, network-level access restriction is the most reliable compensating control while the CPU patch is scheduled.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Reports Developer is part of the Oracle Fusion Middleware reporting stack (Oracle Reports / Oracle Business Intelligence Publisher lineage), used to design and serve enterprise reports over HTTP via the Reports Server/Servlet. The vulnerable component is 'Security and Authentication,' which governs how the reporting tier validates requesters before granting access to report execution and administrative functions. Oracle did not assign a CWE (CWE: N/A), so the precise root-cause class is not disclosed; the combination of the affected component plus 'takeover' impact is consistent with an authentication bypass or broken access control in the HTTP-facing report service, but the exact defect type is not confirmed in the available data.
Know when Reports Developer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle describes unauthenticated network HTTP exploitation resulting in full product takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H is warranted.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in takeover of Oracle Reports Developer. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Organizations running Oracle Reports Developer 14.1.2.0.0 face immediate risk of complete system compromise through unauthenticated network attack, with no current vendor patch available. This vulnerability threatens data confidentiality and system availability across dependent applications. The combination of critical severity and patch unavailability requires urgent containment actions.
Implement network segmentation and firewall rules restricting access to authorized IP ranges; require VPN authentication for all connections; deploy intrusion detection/prevention systems monitoring for exploitation signatures; enable comprehensive logging of authentication failures and HTTP traffic to the component; consider temporary decommissioning of non-critical instances; maintain daily monitoring of Oracle Security Advisories for patch announcements.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Reports Developer
View allVulnerability in the Oracle Reports Developer component of Oracle Fusion Middleware (subcomponent: Valid Session). Rated
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible when a low-privileged att
Full takeover of Oracle Reports Developer 14.1.2.0.0 (a component of Oracle Fusion Middleware) is possible for a remote,
Full compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware) is possible by a remote, unauthenticat
Complete takeover of Oracle Reports Developer 12.2.1.19.0 is achievable by a remote, unauthenticated attacker over HTTP,
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component)
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible for a remote, unauthenticated attacker who can reac
Full system takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication compo
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible by a remote, unauthenticated attacker over TCP, per
Full compromise of Oracle Reports Developer 12.2.1.19.0 is possible when an unauthenticated attacker reaches the product
Remote takeover of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible via a Security and Authen
Exploit-DB