Oracle Reports Developer EUVD-2026-61625

Exploitation requires either adjacency to the local network segment hosting Oracle Reports Developer (AV:A per the description-embedded vector) or direct physical access to the hardware (AV:P per the separately provided vector field) - this conflict is unresolved and must be clarified via the Oracle advisory. No authentication is required (PR:N) and no user interaction is needed (UI:N). The target must be running Oracle Reports Developer version 14.1.2.0.0 specifically. The key limiting factor is network proximity: an attacker cannot exploit this vulnerability from an arbitrary internet location - they must already have a foothold on the adjacent network segment, which constrains opportunistic internet-scale exploitation. Physical access scenarios are even more restrictive. Defenders with proper network segmentation separating the Fusion Middleware tier from untrusted zones significantly reduce realistic exposure.

The two CVSS vectors embedded in the source data present conflicting attack-vector assessments: the description text encodes AV:A (Adjacent Network, yielding a score of 9.6), while the separately supplied CVSS vector field records AV:P (Physical access, yielding 7.6). This is not a minor discrepancy - adjacent-network exploitability is dramatically more accessible to threat actors than physical hardware access, and the correct vector fundamentally changes the threat model. The EPSS score of 0.26% at the 18th percentile indicates very low observed exploitation probability across the broader vulnerability ecosystem, and there is no CISA KEV listing to confirm active in-the-wild exploitation. Despite the high raw CVSS score, the combination of low EPSS, no known POC, and an ambiguous attack vector suggests this is currently a theoretical rather than actively weaponized risk - though the confirmed scope change means the potential blast radius warrants prompt patching rather than deferral. The unauthenticated nature (PR:N, UI:N) means no credential compromise is required as a prerequisite, which removes a significant friction layer for attackers once they achieve the required proximity.

An unauthenticated attacker positioned on the same local network segment as the Oracle Reports Developer host sends crafted requests that bypass the Security and Authentication component, exploiting the improper access control flaw (CWE-284) without providing any credentials. The attacker achieves full control over the Reports Developer instance - including confidentiality, integrity, and availability - and due to the confirmed scope change, may subsequently pivot to affect other Oracle Fusion Middleware services sharing the same platform. No public proof-of-concept code has been identified at time of analysis.