Reports Developer
Monthly
Oracle Reports Developer 14.1.2.0.0, a component of Oracle Fusion Middleware, allows unauthenticated remote attackers to fully compromise the system via a network-accessible HTTP attack against its Security and Authentication component. Successful exploitation results in complete takeover - achieving high confidentiality, integrity, and availability impact - consistent with full control over the affected instance. No public exploit code has been identified at time of analysis, and exploitation requires high attack complexity (AC:H), meaning real-world exploitation depends on meeting specific non-trivial preconditions.
Authentication bypass in Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) allows a remote unauthenticated attacker to reach and compromise the reporting service over HTTP, exposing critical data and enabling partial data modification. The scope-changing flaw (CVSS 3.1 9.3) can also significantly impact adjacent products beyond Reports Developer itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low-complexity, no-privilege, no-interaction profile makes it high priority.
Oracle Reports Developer 14.1.2.0.0 contains an authentication bypass in its Security and Authentication component that permits unauthenticated, network-based attackers to achieve both complete data disclosure and unauthorized modification of critical data over HTTP. The vulnerability requires no credentials or user interaction, though the high attack complexity (AC:H) means exploitation demands precise conditions or crafted request sequences. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated network reach combined with dual high-impact outcomes warrants urgent remediation for any internet-exposed or untrusted-network-accessible deployments.
Oracle Reports Developer 14.1.2.0.0 contains an authentication bypass flaw in its Security and Authentication component that allows a low-privileged network attacker to gain unauthorized read and write access to all data managed by the application over HTTP. Rated 8.1 CVSS with low attack complexity and no user interaction required, this represents a significant confidentiality and integrity risk for any organization with Oracle Reports Developer exposed on a network-accessible interface. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Reports Developer 14.1.2.0.0 is exposed to a full system takeover through an authentication bypass (CWE-284) in its Security and Authentication component, exploitable by unauthenticated attackers with access to the adjacent network segment hosting the software. Two conflicting CVSS vectors are present in the source data - the embedded description asserts AV:A (Adjacent Network, score 9.6) while the separately provided vector field records AV:P (Physical, score 7.6) - a material discrepancy that affects risk prioritization and requires vendor clarification. Scope change (S:C) is confirmed, meaning successful exploitation may extend impact to other Oracle Fusion Middleware components; no public exploit or CISA KEV listing has been identified, and EPSS probability is very low at 0.26%.
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible when an unauthenticated remote attacker sends crafted HTTP requests to the Security and Authentication component of this Oracle Fusion Middleware reporting tool. The flaw carries a CVSS 9.8 base score with full confidentiality, integrity, and availability impact, and requires no privileges or user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; it was disclosed via Oracle's August 2026 Critical Patch Update.
Remote unauthenticated compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) is possible over the network via SOAP, letting an attacker read, create, delete, or modify all data accessible to the product. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact and no availability impact, and flagged as an authentication-bypass class issue, it was addressed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) is possible for an unauthenticated attacker who can reach the service over IIOP. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) the flaw is network-reachable, low-complexity, and requires no credentials or user interaction, yielding full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV; it was reported by Oracle and fixed in the August 2026 Critical Patch Update.
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible for a remote, unauthenticated attacker who can reach the product's CORBA interface over the network, per the Oracle Critical Patch Update of August 2026. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is rated by Oracle as easily exploitable. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Unauthenticated data tampering and denial-of-service in Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) lets a remote attacker over HTTP create, delete, or modify all Reports Developer-accessible data and trigger a complete, repeatable crash. The flaw carries a CVSS 3.1 base score of 9.1 with high integrity and availability impact but no confidentiality impact, and was disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Oracle Reports Developer 14.1.2.0.0 exposes an unauthenticated authentication bypass in its Security and Authentication component, allowing an attacker on the same physical network segment to fully compromise confidentiality and integrity of all accessible data - including critical data - without any credentials or user interaction. The vulnerability carries a scope change, meaning successful exploitation may cascade to impact additional Oracle Fusion Middleware products beyond Reports Developer itself. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.22% (13th percentile), suggesting low opportunistic risk despite the critical vendor-stated CVSS base score.
Unauthenticated remote exploitation of Oracle Reports Developer 14.1.2.0.0 via the SOAP interface allows attackers to read all data accessible to the application, perform partial data modification, and cause partial service disruption without credentials or user interaction. The vulnerability resides in the Security and Authentication component of Oracle Fusion Middleware, meaning authentication enforcement over the SOAP protocol can be bypassed entirely. No active exploitation has been confirmed at time of analysis, but the network-accessible, zero-authentication attack vector makes this a high-priority patching target for any organization with this product exposed beyond strictly controlled network segments.
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) allows an unauthenticated attacker with only HTTP network access to fully compromise the product, per Oracle's Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and no user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and unauthenticated network vector make it a high-priority patch target.
Full system takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) is possible when a remote, unauthenticated attacker reaches the product over CORBA. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing nature makes it a top-priority patch item.
Full takeover of Oracle Reports Developer 14.1.2.0.0 (a component of Oracle Fusion Middleware) is possible for a remote, unauthenticated attacker over HTTP, carrying a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact. Disclosed in Oracle's August 2026 Critical Patch Update (cross-referenced as ENISA EUVD-2026-61615), the flaw sits in the Security and Authentication component and permits complete compromise of the product without credentials or user interaction. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware) is possible by a remote, unauthenticated attacker over HTTP against the Security and Authentication component, per Oracle's August 2026 Critical Patch Update. Oracle rates it CVSS 9.8 with high confidentiality, integrity, and availability impact, describing 'takeover' of the product. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible by a remote, unauthenticated attacker over TCP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Security and Authentication component and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch.
Unauthenticated remote compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) allows attackers with only HTTP network access to tamper with or destroy critical data, read a subset of accessible data, and force a complete denial of service. Oracle rates this CVSS 9.4, reflecting high integrity and availability impact combined with trivial exploitability and no authentication requirement. No public exploit identified at time of analysis, but the low-complexity, no-privileges vector makes it a high-priority patch from Oracle's August 2026 Critical Patch Update.
Authentication bypass in Oracle Reports Developer 12.2.1.19.0 exposes critical data to unauthenticated remote attackers over TCP, with a scope change confirmed by the vendor meaning downstream Oracle Fusion Middleware components can also be compromised. The CVSS 3.1 score of 8.6 reflects a network-accessible, zero-interaction attack path yielding high confidentiality impact across system boundaries. No public exploit code has been identified at time of analysis, though the vendor's own 'easily exploitable' classification substantially lowers the operational barrier for threat actors.
Oracle Reports Developer 12.2.1.19.0, a component of Oracle Fusion Middleware, exposes a network-exploitable authentication/security bypass in its Security and Authentication component that allows a low-privileged attacker to gain complete unauthorized read access to all data accessible by the application and limited write access to some data. The scope change (S:C) in the CVSS vector confirms that a successful attack can cascade and significantly impact additional products beyond Oracle Reports Developer itself. No public exploit code or active exploitation has been identified at time of analysis, and Oracle classifies this as difficult to exploit (AC:H).
Complete takeover of Oracle Reports Developer 12.2.1.19.0 is achievable by a remote, unauthenticated attacker over HTTP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the product's Security and Authentication component and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch.
Unauthenticated remote compromise of Oracle Reports Developer 12.2.1.19.0 is achievable via crafted SOAP requests targeting the Security and Authentication component, confirming an authentication bypass condition. The CVSS 3.1 vector (PR:N, AV:N, AC:L) indicates no credentials or user interaction are required, and the high confidentiality impact reflects full data exposure across all data accessible to the Reports Developer service. Additionally, limited integrity and availability degradation are possible, making this a high-priority patch candidate for any Oracle Fusion Middleware deployment running this version. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full compromise of Oracle Reports Developer 12.2.1.19.0 is possible when an unauthenticated attacker reaches the product over the network via the IIOP protocol, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Security and Authentication component and yields complete takeover with high confidentiality, integrity, and availability impact (CVSS 9.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.
Remote takeover of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) allows an unauthenticated attacker with network access over the IIOP protocol to fully compromise the product, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible via a Security and Authentication component flaw that lets a remote attacker take over the product over TCP without credentials or user interaction. Oracle rates it CVSS 9.8 with complete confidentiality, integrity, and availability loss, and describes it as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch in the August 2026 Critical Patch Update.
Unauthenticated remote exploitation of Oracle Reports Developer 12.2.1.19.0 exposes all data accessible to the application via HTTP, with confirmed scope change that can impact additional downstream products within the Oracle Fusion Middleware environment. The vulnerability resides in the Security and Authentication component and is tagged as an authentication bypass, meaning attackers require no credentials to exploit it. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this straightforward to exploit once a target instance is reachable.
Full system takeover in Oracle Reports Developer 12.2.1.19.0 is achievable by unauthenticated remote attackers over HTTP, though exploitation requires human interaction from a victim user. The vulnerability resides in the Security and Authentication component of Oracle Fusion Middleware, and successful exploitation yields complete confidentiality, integrity, and availability compromise of the target instance. Oracle classifies the flaw as 'easily exploitable' in its August 2026 Critical Patch Update; no public exploit has been identified and the vulnerability is not listed in CISA KEV, meaning active exploitation is not confirmed at time of analysis.
Unauthenticated remote compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) allows a network attacker to reach protected data and cross a trust boundary into other products. An attacker with only HTTP access can read all data accessible to Oracle Reports Developer and make limited unauthorized modifications, and because the flaw is scope-changing it can significantly impact additional products beyond Reports Developer itself. It carries a CVSS 3.1 base score of 9.3 and is addressed in Oracle's August 2026 Critical Patch Update; no public exploit identified at time of analysis.
Remote takeover in Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) lets an unauthenticated network attacker fully compromise the product via UDP. Oracle rates the flaw CVSS 9.8 with high confidentiality, integrity, and availability impact and describes it as easily exploitable. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote exploitation of Oracle Reports Developer 12.2.1.19.0 via SMTP allows attackers to perform unauthorized data manipulation and cause a partial denial of service against the affected instance. The vulnerability resides in the Security and Authentication component of Oracle Fusion Middleware, and carries a scope-change designation indicating that successful attacks may cascade to impact additional Oracle products sharing the same environment. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Reports Developer 12.2.1.19.0 can be fully compromised by low-privileged, authenticated attackers over HTTP, resulting in complete system takeover with full confidentiality, integrity, and availability loss. The flaw resides in the Security and Authentication component of Oracle Fusion Middleware, and carries a scope-changing impact - successful exploitation may cascade into additional Fusion Middleware products beyond Reports Developer itself. No public exploit code or CISA KEV listing exists at time of analysis; however, the full-takeover potential and cross-component scope change elevate this beyond typical high-complexity findings.
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible for a remote, unauthenticated attacker over HTTP via the Security and Authentication component. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle describes successful attacks as resulting in complete takeover of the product. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable takeover profile makes it a high patch priority.
Improper access control in Oracle Reports Developer 12.2.1.19.0 enables unauthenticated attackers positioned on the same network segment as the host to fully compromise confidentiality and integrity of all data accessible by the product, with scope change allowing impact to additional Oracle Fusion Middleware components. The vulnerability carries tags of Authentication Bypass and is tracked under CWE-284 (Improper Access Control). No public exploit code or CISA KEV entry exists at time of analysis, and the EPSS score of 0.22% (13th percentile) reflects low observed exploitation probability despite the high theoretical severity.
Full system takeover of Oracle Reports Developer 12.2.1.19.0 is achievable by any low-privileged authenticated user with HTTP network access, exploiting a flaw in the Security and Authentication component of Oracle Fusion Middleware. Oracle classifies this as 'easily exploitable,' and the CVSS 3.1 score of 8.8 reflects complete confidentiality, integrity, and availability impact - effectively equivalent to administrative compromise of the affected instance. No public exploit code or active exploitation has been identified at time of analysis, but the low attack barrier significantly narrows the defender's window.
Remote unauthenticated takeover in Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) allows an attacker with network access via the IIOP protocol to fully compromise the product without credentials or user interaction. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, this was disclosed in Oracle's August 2026 Critical Patch Update (CPUAUG2026). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) lets a remote, unauthenticated attacker reach and manipulate the reporting service over HTTP, gaining read access to all data the product can reach and the ability to create, delete, or modify that data. Rated CVSS 3.1 9.1 (Critical) with high confidentiality and integrity impact but no availability impact, it was disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible by a remote, unauthenticated attacker over TCP, per Oracle's August 2026 Critical Patch Update. The flaw resides in the Security and Authentication component and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit identified at time of analysis, but the trivial exploitability and complete-takeover outcome make this a high-priority patch.
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible when a low-privileged attacker reaches the product over the network via the CORBA protocol, per Oracle's August 2026 Critical Patch Update. Because the flaw carries a scope change, successful exploitation can take over the Reports Developer instance and significantly impact other products beyond the vulnerable component, yielding full confidentiality, integrity, and availability loss (CVSS 3.1 base 9.9). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Full system takeover of Oracle Reports Developer 14.1.2.0.0 is achievable by an unauthenticated attacker physically co-located on the same network segment as the affected host. The Security and Authentication component contains an easily exploitable flaw - CVSS AC:L and PR:N confirm no elevated privileges or complexity are required once adjacent network access is established. Successful exploitation yields complete confidentiality, integrity, and availability compromise of the Oracle Reports Developer instance. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Full system takeover of Oracle Reports Developer 14.1.2.0.0 is achievable by an unauthenticated attacker present on the same physical network segment as the host running the software. The vulnerability resides in the Security and Authentication component of this Oracle Fusion Middleware product, meaning the mechanism meant to enforce access control can be bypassed without credentials. With a CVSS 3.1 score of 8.8, the impact spans complete confidentiality, integrity, and availability compromise; no public exploit or CISA KEV listing has been identified at time of analysis.
Full compromise of Oracle Reports Developer 12.2.1.19.0 is achievable by an unauthenticated attacker who has access to the same physical or logical network segment as the host running the software. The flaw resides in the Security and Authentication component of this Oracle Fusion Middleware product, and successful exploitation yields complete confidentiality, integrity, and availability impact - effectively a full system takeover. No public exploit or CISA KEV listing exists at time of analysis, but the combination of no required privileges, no user interaction, and a low-complexity attack makes this a credible threat within the adjacent network boundary.
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Servlet). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Reports Developer component of Oracle Fusion Middleware (subcomponent: Valid Session). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Oracle Reports Developer 14.1.2.0.0, a component of Oracle Fusion Middleware, allows unauthenticated remote attackers to fully compromise the system via a network-accessible HTTP attack against its Security and Authentication component. Successful exploitation results in complete takeover - achieving high confidentiality, integrity, and availability impact - consistent with full control over the affected instance. No public exploit code has been identified at time of analysis, and exploitation requires high attack complexity (AC:H), meaning real-world exploitation depends on meeting specific non-trivial preconditions.
Authentication bypass in Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) allows a remote unauthenticated attacker to reach and compromise the reporting service over HTTP, exposing critical data and enabling partial data modification. The scope-changing flaw (CVSS 3.1 9.3) can also significantly impact adjacent products beyond Reports Developer itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low-complexity, no-privilege, no-interaction profile makes it high priority.
Oracle Reports Developer 14.1.2.0.0 contains an authentication bypass in its Security and Authentication component that permits unauthenticated, network-based attackers to achieve both complete data disclosure and unauthorized modification of critical data over HTTP. The vulnerability requires no credentials or user interaction, though the high attack complexity (AC:H) means exploitation demands precise conditions or crafted request sequences. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated network reach combined with dual high-impact outcomes warrants urgent remediation for any internet-exposed or untrusted-network-accessible deployments.
Oracle Reports Developer 14.1.2.0.0 contains an authentication bypass flaw in its Security and Authentication component that allows a low-privileged network attacker to gain unauthorized read and write access to all data managed by the application over HTTP. Rated 8.1 CVSS with low attack complexity and no user interaction required, this represents a significant confidentiality and integrity risk for any organization with Oracle Reports Developer exposed on a network-accessible interface. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Reports Developer 14.1.2.0.0 is exposed to a full system takeover through an authentication bypass (CWE-284) in its Security and Authentication component, exploitable by unauthenticated attackers with access to the adjacent network segment hosting the software. Two conflicting CVSS vectors are present in the source data - the embedded description asserts AV:A (Adjacent Network, score 9.6) while the separately provided vector field records AV:P (Physical, score 7.6) - a material discrepancy that affects risk prioritization and requires vendor clarification. Scope change (S:C) is confirmed, meaning successful exploitation may extend impact to other Oracle Fusion Middleware components; no public exploit or CISA KEV listing has been identified, and EPSS probability is very low at 0.26%.
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible when an unauthenticated remote attacker sends crafted HTTP requests to the Security and Authentication component of this Oracle Fusion Middleware reporting tool. The flaw carries a CVSS 9.8 base score with full confidentiality, integrity, and availability impact, and requires no privileges or user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; it was disclosed via Oracle's August 2026 Critical Patch Update.
Remote unauthenticated compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) is possible over the network via SOAP, letting an attacker read, create, delete, or modify all data accessible to the product. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact and no availability impact, and flagged as an authentication-bypass class issue, it was addressed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) is possible for an unauthenticated attacker who can reach the service over IIOP. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) the flaw is network-reachable, low-complexity, and requires no credentials or user interaction, yielding full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV; it was reported by Oracle and fixed in the August 2026 Critical Patch Update.
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible for a remote, unauthenticated attacker who can reach the product's CORBA interface over the network, per the Oracle Critical Patch Update of August 2026. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is rated by Oracle as easily exploitable. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Unauthenticated data tampering and denial-of-service in Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) lets a remote attacker over HTTP create, delete, or modify all Reports Developer-accessible data and trigger a complete, repeatable crash. The flaw carries a CVSS 3.1 base score of 9.1 with high integrity and availability impact but no confidentiality impact, and was disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Oracle Reports Developer 14.1.2.0.0 exposes an unauthenticated authentication bypass in its Security and Authentication component, allowing an attacker on the same physical network segment to fully compromise confidentiality and integrity of all accessible data - including critical data - without any credentials or user interaction. The vulnerability carries a scope change, meaning successful exploitation may cascade to impact additional Oracle Fusion Middleware products beyond Reports Developer itself. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.22% (13th percentile), suggesting low opportunistic risk despite the critical vendor-stated CVSS base score.
Unauthenticated remote exploitation of Oracle Reports Developer 14.1.2.0.0 via the SOAP interface allows attackers to read all data accessible to the application, perform partial data modification, and cause partial service disruption without credentials or user interaction. The vulnerability resides in the Security and Authentication component of Oracle Fusion Middleware, meaning authentication enforcement over the SOAP protocol can be bypassed entirely. No active exploitation has been confirmed at time of analysis, but the network-accessible, zero-authentication attack vector makes this a high-priority patching target for any organization with this product exposed beyond strictly controlled network segments.
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) allows an unauthenticated attacker with only HTTP network access to fully compromise the product, per Oracle's Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and no user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and unauthenticated network vector make it a high-priority patch target.
Full system takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) is possible when a remote, unauthenticated attacker reaches the product over CORBA. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing nature makes it a top-priority patch item.
Full takeover of Oracle Reports Developer 14.1.2.0.0 (a component of Oracle Fusion Middleware) is possible for a remote, unauthenticated attacker over HTTP, carrying a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact. Disclosed in Oracle's August 2026 Critical Patch Update (cross-referenced as ENISA EUVD-2026-61615), the flaw sits in the Security and Authentication component and permits complete compromise of the product without credentials or user interaction. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware) is possible by a remote, unauthenticated attacker over HTTP against the Security and Authentication component, per Oracle's August 2026 Critical Patch Update. Oracle rates it CVSS 9.8 with high confidentiality, integrity, and availability impact, describing 'takeover' of the product. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible by a remote, unauthenticated attacker over TCP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Security and Authentication component and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch.
Unauthenticated remote compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) allows attackers with only HTTP network access to tamper with or destroy critical data, read a subset of accessible data, and force a complete denial of service. Oracle rates this CVSS 9.4, reflecting high integrity and availability impact combined with trivial exploitability and no authentication requirement. No public exploit identified at time of analysis, but the low-complexity, no-privileges vector makes it a high-priority patch from Oracle's August 2026 Critical Patch Update.
Authentication bypass in Oracle Reports Developer 12.2.1.19.0 exposes critical data to unauthenticated remote attackers over TCP, with a scope change confirmed by the vendor meaning downstream Oracle Fusion Middleware components can also be compromised. The CVSS 3.1 score of 8.6 reflects a network-accessible, zero-interaction attack path yielding high confidentiality impact across system boundaries. No public exploit code has been identified at time of analysis, though the vendor's own 'easily exploitable' classification substantially lowers the operational barrier for threat actors.
Oracle Reports Developer 12.2.1.19.0, a component of Oracle Fusion Middleware, exposes a network-exploitable authentication/security bypass in its Security and Authentication component that allows a low-privileged attacker to gain complete unauthorized read access to all data accessible by the application and limited write access to some data. The scope change (S:C) in the CVSS vector confirms that a successful attack can cascade and significantly impact additional products beyond Oracle Reports Developer itself. No public exploit code or active exploitation has been identified at time of analysis, and Oracle classifies this as difficult to exploit (AC:H).
Complete takeover of Oracle Reports Developer 12.2.1.19.0 is achievable by a remote, unauthenticated attacker over HTTP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the product's Security and Authentication component and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch.
Unauthenticated remote compromise of Oracle Reports Developer 12.2.1.19.0 is achievable via crafted SOAP requests targeting the Security and Authentication component, confirming an authentication bypass condition. The CVSS 3.1 vector (PR:N, AV:N, AC:L) indicates no credentials or user interaction are required, and the high confidentiality impact reflects full data exposure across all data accessible to the Reports Developer service. Additionally, limited integrity and availability degradation are possible, making this a high-priority patch candidate for any Oracle Fusion Middleware deployment running this version. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full compromise of Oracle Reports Developer 12.2.1.19.0 is possible when an unauthenticated attacker reaches the product over the network via the IIOP protocol, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Security and Authentication component and yields complete takeover with high confidentiality, integrity, and availability impact (CVSS 9.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.
Remote takeover of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) allows an unauthenticated attacker with network access over the IIOP protocol to fully compromise the product, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible via a Security and Authentication component flaw that lets a remote attacker take over the product over TCP without credentials or user interaction. Oracle rates it CVSS 9.8 with complete confidentiality, integrity, and availability loss, and describes it as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch in the August 2026 Critical Patch Update.
Unauthenticated remote exploitation of Oracle Reports Developer 12.2.1.19.0 exposes all data accessible to the application via HTTP, with confirmed scope change that can impact additional downstream products within the Oracle Fusion Middleware environment. The vulnerability resides in the Security and Authentication component and is tagged as an authentication bypass, meaning attackers require no credentials to exploit it. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this straightforward to exploit once a target instance is reachable.
Full system takeover in Oracle Reports Developer 12.2.1.19.0 is achievable by unauthenticated remote attackers over HTTP, though exploitation requires human interaction from a victim user. The vulnerability resides in the Security and Authentication component of Oracle Fusion Middleware, and successful exploitation yields complete confidentiality, integrity, and availability compromise of the target instance. Oracle classifies the flaw as 'easily exploitable' in its August 2026 Critical Patch Update; no public exploit has been identified and the vulnerability is not listed in CISA KEV, meaning active exploitation is not confirmed at time of analysis.
Unauthenticated remote compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) allows a network attacker to reach protected data and cross a trust boundary into other products. An attacker with only HTTP access can read all data accessible to Oracle Reports Developer and make limited unauthorized modifications, and because the flaw is scope-changing it can significantly impact additional products beyond Reports Developer itself. It carries a CVSS 3.1 base score of 9.3 and is addressed in Oracle's August 2026 Critical Patch Update; no public exploit identified at time of analysis.
Remote takeover in Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) lets an unauthenticated network attacker fully compromise the product via UDP. Oracle rates the flaw CVSS 9.8 with high confidentiality, integrity, and availability impact and describes it as easily exploitable. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote exploitation of Oracle Reports Developer 12.2.1.19.0 via SMTP allows attackers to perform unauthorized data manipulation and cause a partial denial of service against the affected instance. The vulnerability resides in the Security and Authentication component of Oracle Fusion Middleware, and carries a scope-change designation indicating that successful attacks may cascade to impact additional Oracle products sharing the same environment. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Reports Developer 12.2.1.19.0 can be fully compromised by low-privileged, authenticated attackers over HTTP, resulting in complete system takeover with full confidentiality, integrity, and availability loss. The flaw resides in the Security and Authentication component of Oracle Fusion Middleware, and carries a scope-changing impact - successful exploitation may cascade into additional Fusion Middleware products beyond Reports Developer itself. No public exploit code or CISA KEV listing exists at time of analysis; however, the full-takeover potential and cross-component scope change elevate this beyond typical high-complexity findings.
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible for a remote, unauthenticated attacker over HTTP via the Security and Authentication component. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle describes successful attacks as resulting in complete takeover of the product. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable takeover profile makes it a high patch priority.
Improper access control in Oracle Reports Developer 12.2.1.19.0 enables unauthenticated attackers positioned on the same network segment as the host to fully compromise confidentiality and integrity of all data accessible by the product, with scope change allowing impact to additional Oracle Fusion Middleware components. The vulnerability carries tags of Authentication Bypass and is tracked under CWE-284 (Improper Access Control). No public exploit code or CISA KEV entry exists at time of analysis, and the EPSS score of 0.22% (13th percentile) reflects low observed exploitation probability despite the high theoretical severity.
Full system takeover of Oracle Reports Developer 12.2.1.19.0 is achievable by any low-privileged authenticated user with HTTP network access, exploiting a flaw in the Security and Authentication component of Oracle Fusion Middleware. Oracle classifies this as 'easily exploitable,' and the CVSS 3.1 score of 8.8 reflects complete confidentiality, integrity, and availability impact - effectively equivalent to administrative compromise of the affected instance. No public exploit code or active exploitation has been identified at time of analysis, but the low attack barrier significantly narrows the defender's window.
Remote unauthenticated takeover in Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) allows an attacker with network access via the IIOP protocol to fully compromise the product without credentials or user interaction. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, this was disclosed in Oracle's August 2026 Critical Patch Update (CPUAUG2026). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) lets a remote, unauthenticated attacker reach and manipulate the reporting service over HTTP, gaining read access to all data the product can reach and the ability to create, delete, or modify that data. Rated CVSS 3.1 9.1 (Critical) with high confidentiality and integrity impact but no availability impact, it was disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible by a remote, unauthenticated attacker over TCP, per Oracle's August 2026 Critical Patch Update. The flaw resides in the Security and Authentication component and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit identified at time of analysis, but the trivial exploitability and complete-takeover outcome make this a high-priority patch.
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible when a low-privileged attacker reaches the product over the network via the CORBA protocol, per Oracle's August 2026 Critical Patch Update. Because the flaw carries a scope change, successful exploitation can take over the Reports Developer instance and significantly impact other products beyond the vulnerable component, yielding full confidentiality, integrity, and availability loss (CVSS 3.1 base 9.9). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Full system takeover of Oracle Reports Developer 14.1.2.0.0 is achievable by an unauthenticated attacker physically co-located on the same network segment as the affected host. The Security and Authentication component contains an easily exploitable flaw - CVSS AC:L and PR:N confirm no elevated privileges or complexity are required once adjacent network access is established. Successful exploitation yields complete confidentiality, integrity, and availability compromise of the Oracle Reports Developer instance. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Full system takeover of Oracle Reports Developer 14.1.2.0.0 is achievable by an unauthenticated attacker present on the same physical network segment as the host running the software. The vulnerability resides in the Security and Authentication component of this Oracle Fusion Middleware product, meaning the mechanism meant to enforce access control can be bypassed without credentials. With a CVSS 3.1 score of 8.8, the impact spans complete confidentiality, integrity, and availability compromise; no public exploit or CISA KEV listing has been identified at time of analysis.
Full compromise of Oracle Reports Developer 12.2.1.19.0 is achievable by an unauthenticated attacker who has access to the same physical or logical network segment as the host running the software. The flaw resides in the Security and Authentication component of this Oracle Fusion Middleware product, and successful exploitation yields complete confidentiality, integrity, and availability impact - effectively a full system takeover. No public exploit or CISA KEV listing exists at time of analysis, but the combination of no required privileges, no user interaction, and a low-complexity attack makes this a credible threat within the adjacent network boundary.
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Servlet). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Reports Developer component of Oracle Fusion Middleware (subcomponent: Valid Session). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.