Description
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 12.2.1.19.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in takeover of Oracle Reports Developer. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability in Oracle Reports Developer 12.2.1.19.0 enables an unauthenticated attacker with network access via IIOP to compromise the application. The flaw permits a takeover that results in full confidentiality, integrity, and availability loss, allowing attackers to bypass authentication and gain control over the system, leading to remote code execution.

Affected Systems

Oracle Reports Developer version 12.2.1.19.0, part of Oracle Fusion Middleware. No other versions or products are listed as affected.

Risk and Exploitability

The CVSS v3.1 base score of 9.8 marks this as critical, with an attack vector that is network‑based and easy to exploit. The EPSS score of 0.00486 indicates a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. An attacker could remotely gain full control over the target without needing credentials.

Generated by OpenCVE AI on August 27, 2026 at 00:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑published patch or upgrade Oracle Reports Developer to a fixed version as soon as it is available.
  • If a patch is not yet available, restrict IIOP access to trusted networks or block IIOP traffic from untrusted sources.
  • Monitor authentication and application logs for anomalous activity and enforce strict network segmentation to limit exposure.

Generated by OpenCVE AI on August 27, 2026 at 00:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 00:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated IIOP Exploit Compromising Oracle Reports Developer 12.2.1.19.0

Wed, 26 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution via IIOP in Oracle Reports Developer 12.2.1.19.0
Weaknesses CWE-287

Wed, 26 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Wed, 26 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution via IIOP in Oracle Reports Developer 12.2.1.19.0
Weaknesses CWE-287

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 12.2.1.19.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in takeover of Oracle Reports Developer. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle reports Developer
CPEs cpe:2.3:a:oracle:reports_developer:12.2.1.19.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle reports Developer
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Reports Developer
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-26T15:24:42.537Z

Reserved: 2026-07-14T14:54:48.744Z

Link: CVE-2026-62611

cve-icon Vulnrichment

Updated: 2026-08-26T13:50:46.746Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:13.670

Modified: 2026-08-26T17:15:58.807

Link: CVE-2026-62611

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-27T00:30:14Z

Weaknesses