EUVD-2026-61628
GHSA-9552-qpgf-77gj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Reports HTTP endpoint
-
DeliverySend crafted authentication-bypass request
-
ExploitGain unauthenticated access to Reports Developer
-
ExecutionRead critical report data
-
PersistPerform limited data insert/update/delete
-
ImpactPivot to adjacent Fusion Middleware (scope change)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network HTTP access to an exposed Oracle Reports Developer 14.1.2.0.0 instance (Security and Authentication component); per the CVSS vector AV:N/AC:L/PR:N/UI:N there are no authentication, privilege, or user-interaction prerequisites, so any actor able to route HTTP to the Reports endpoint can attempt it. The primary limiting factors are exposure and version: only version 14.1.2.0.0 is named as affected, and risk drops sharply if the Reports servlet/server is not reachable from untrusted networks (e.g., internal-only, behind a VPN, or fronted by an authenticating proxy). The scope-change component (S:C) means impact is not confined to Reports Developer, raising the stakes where it is co-deployed with other Fusion Middleware products. |
| Impact | The signals are largely aligned toward high priority: CVSS 3.1 9.3 with AV:N/AC:L/PR:N/UI:N means remote, low-complexity, unauthenticated exploitation with no user interaction, and S:C amplifies blast radius across products. Confidentiality impact is High while Integrity is Low and Availability is None, so this is primarily a data-exposure and partial-tampering risk rather than a service-takedown or full-write compromise. Countervailing factors: no EPSS score was provided, it is not in CISA KEV, and no POC was supplied, so there is no evidence of active or automated exploitation yet - the risk is currently driven by exploitability profile and Oracle's own severity rating, not by observed attacks. Net: treat as an urgent patch item given trivial exploitability and scope change, while recognizing exploitation-in-the-wild is unconfirmed. |
| Exploit ScenarioDerived | An attacker who can reach the Oracle Reports Developer HTTP endpoint sends crafted requests that bypass the authentication check, gaining access without any credentials or user interaction. From there they read critical report data and can perform limited unauthorized inserts/updates/deletes, and because of the scope change may pivot into adjacent Fusion Middleware resources. No public POC is available at time of analysis, but the low attack complexity means a working exploit would be straightforward to develop. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Authentication bypass in Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) allows a remote unauthenticated attacker to reach and compromise the reporting service over HTTP, exposing critical data and enabling partial data modification. The scope-changing flaw (CVSS 3.1 9.3) can also significantly impact adjacent products beyond Reports Developer itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low-complexity, no-privilege, no-interaction profile makes it high priority.
RemediationAI
Apply the Oracle Critical Patch Update for August 2026 as tracked in the vendor advisory at https://www.oracle.com/security-alerts/cspuaug2026.html; patch is available per vendor advisory though an exact fixed build number is not stated in the available data, so consult the CPU matrix for the precise patch for 14.1.2.0.0. Until patched, restrict network reachability of the Oracle Reports servlet/server endpoints to trusted management networks or place them behind an authenticating reverse proxy or WAF, and block direct external HTTP access to the Reports Server URL - the trade-off is that legitimate remote report consumers must be re-routed through the proxy or VPN and some integrations may break. Because this is a scope-changing authentication bypass, also review and segment any co-hosted Fusion Middleware components that share the same trust boundary to limit lateral impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Reports Developer is a legacy enterprise reporting engine within the Oracle Fusion Middleware stack, typically fronted by the Oracle Reports Servlet/Server over HTTP. The defect lives in the Security and Authentication component, and the vendor's own 'Authentication Bypass' tag indicates the flaw class is a broken/bypassable authentication control (a CWE-287/CWE-288 family issue) rather than a memory-safety bug; NVD records no CWE. Because the CVSS vector carries S:C (scope change), the vulnerable authentication layer sits at a trust boundary where a successful bypass can extend privileges into other Fusion Middleware components sharing that boundary, not just Reports Developer's own data domain.
Know when Reports Developer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Unauthenticated network HTTP authentication bypass gives PR:N/AV:N/AC:L; High confidentiality with limited write yields C:H/I:L/A:N, and cross-product impact justifies S:C.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Reports Developer. While the vulnerability is in Oracle Reports Developer, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Reports Developer accessible data as well as unauthorized update, insert or delete access to some of Oracle Reports Developer accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).
Executive ViewAI
Oracle Reports Developer 14.1.2.0.0 contains a critical authentication bypass vulnerability enabling unauthenticated remote attackers to access and modify reporting data without valid credentials. This vulnerability poses immediate risk to organizations relying on Reports for sensitive business intelligence and analytics, with potential impact extending to dependent Oracle Fusion Middleware systems. Given the straightforward attack path and current absence of vendor remediation, prompt network containment is essential to prevent data breach.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Network segmentation-restrict inbound access to Reports Developer 14.1.2.0.0 to authorized internal networks only; (2) Disable the Reports service if operationally feasible; (3) Deploy reverse proxy or Web Application Firewall with strict access controls and IP whitelisting; (4) Enable comprehensive audit logging for all Reports Developer activity and configure real-time alerts for authentication anomalies; (5) Assume compromise of all data accessible through Reports Developer pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Reports Developer
View allVulnerability in the Oracle Reports Developer component of Oracle Fusion Middleware (subcomponent: Valid Session). Rated
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible when a low-privileged att
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component)
Full takeover of Oracle Reports Developer 14.1.2.0.0 (a component of Oracle Fusion Middleware) is possible for a remote,
Full compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware) is possible by a remote, unauthenticat
Complete takeover of Oracle Reports Developer 12.2.1.19.0 is achievable by a remote, unauthenticated attacker over HTTP,
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component)
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible for a remote, unauthenticated attacker who can reac
Full system takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication compo
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible by a remote, unauthenticated attacker over TCP, per
Full compromise of Oracle Reports Developer 12.2.1.19.0 is possible when an unauthenticated attacker reaches the product
Remote takeover of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component
Exploit-DB