The flaw is located in the Oracle Reports Developer component of Oracle Fusion Middleware, specifically affecting the Security and Authentication module in version 12.2.1.19.0. The defect allows an unauthenticated attacker who can reach the service over HTTP to compromise the application, culminating in a full takeover. The CVSS 3.1 base score of 8.8 reflects severe impacts on confidentiality, integrity, and availability, indicating that a successful exploitation restores full control over the target.

Oracle Reports Developer version 12.2.1.19.0 in Oracle Fusion Middleware – no other versions are listed in the CNA data as affected.

The CVSS score of 8.8 signals high severity, and while the EPSS score is unavailable, the lack of KEV listing suggests the vulnerability has not yet been widely exploited in known incidents. The likely attack vector is over HTTP; the attacker must establish network access, and the description notes that human interaction from a user other than the attacker is necessary—probably to click a crafted link or execute a malicious payload. Because the flaw involves authentication bypass, a risk assessment should view it as a potential high exposure, especially for systems exposed to the internet or shared networks.