What is the CVSS score of EUVD-2026-61629?

EUVD-2026-61629 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oracle Reports Developer are affected by EUVD-2026-61629?

Oracle Reports Developer 14.1.2.0.0 contains an unpatched vulnerability enabling complete system takeover by unauthenticated attackers with network access on the same segment, affecting any…

How to fix or mitigate EUVD-2026-61629?

Within 24 hours: Identify all Oracle Reports Developer 14.1.2.0.0 instances in production and non-production environments; immediately restrict network access to these systems through firewall rules, removing any internet-facing exposure and limiting connectivity to authorized users only. Within 7 days: Complete a business impact assessment for each instance, prioritizing systems handling sensitive data; document whether this product remains mission-critical or can be replaced or decommissioned. Within 30 days: Execute the remediation plan-either migrate reporting workloads to an alternative supported solution or formally decommission Oracle Reports Developer 14.1.2.0.0; if any instance must remain operational due to business constraints, implement sustained network segmentation and continuous monitoring as a long-term compensating control.

Oracle Reports Developer EUVD-2026-61629

| CVE-2026-70674 MEDIUM

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-h9xq-qqr8-f9j4

Authentication Bypass Oracle Reports Developer

6.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Adjacent network access required per description; unauthenticated and low complexity; full takeover yields high C/I/A with unchanged scope.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Severity Changed

Aug 26, 2026 - 17:38 NVD

HIGH MEDIUM

CVSS changed

Aug 26, 2026 - 17:38 NVD

8.8 (HIGH) 6.8 (MEDIUM)

Analysis Generated

Aug 19, 2026 - 00:11 vuln.today

CVE Published

Aug 18, 2026 - 21:17 nvd

HIGH 8.8

DescriptionNVD

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Reports Developer executes to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in takeover of Oracle Reports Developer. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full system takeover of Oracle Reports Developer 14.1.2.0.0 is achievable by an unauthenticated attacker physically co-located on the same network segment as the affected host. The Security and Authentication component contains an easily exploitable flaw - CVSS AC:L and PR:N confirm no elevated privileges or complexity are required once adjacent network access is established. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The attacker must have access to the physical communication segment attached to the hardware where Oracle Reports Developer 14.1.2.0.0 executes - this means LAN, VLAN, or equivalent adjacent network adjacency is required, not internet-routable access. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 8.8 score reflects a genuinely serious flaw: unauthenticated, low-complexity exploitation yielding full system takeover. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the Oracle Critical Patch Update for August 2026, which addresses this vulnerability for Oracle Reports Developer 14.1.2.0.0. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all Oracle Reports Developer 14.1.2.0.0 instances in production and non-production environments; immediately restrict network access to these systems through firewall rules, removing any internet-facing exposure and limiting connectivity to authorized users only. …

Threat intelligence, references, and detailed analysis are available after sign-in.