This vulnerability enables an unauthenticated attacker with network access via HTTP to compromise Oracle Reports Developer. The flaw provides full unauthorized read access and allows the attacker to update, insert, or delete data that should be protected. The CVSS 3.1 base score of 9.3 reflects high confidentiality impact and moderate integrity impact, indicating a severe potential for data exposure and manipulation.

OEM customers using Oracle Reports Developer version 12.2.1.19.0, part of Oracle Fusion Middleware’s Security and Authentication component. The vulnerability’s scope change means that exploitation could also affect additional products within the same environment.

The CVSS vector captures a network attack with low complexity, no privileges, and no user interaction, confirming that the vulnerability is easily exploitable from outside the organization. An EPSS score of 0.26% indicates a very low exploitation probability, and the issue is not listed in the CISA KEV catalog, but the high CVSS score alone warrants urgent attention. A direct HTTP request to the vulnerable service can trigger the unauthorized data access and tampering, making this risk immediate and significant.