Description
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 12.2.1.19.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in takeover of Oracle Reports Developer. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An unauthenticated attacker who can reach Oracle Reports Developer over TCP can exploit a flaw in the security and authentication component, bypassing normal login requirements. The vulnerability allows the attacker to execute arbitrary code on the target and ultimately take full control of the Reports Developer instance. The attack compromises confidentiality, integrity, and availability of the application and any data it exposes. The flaw is defined by CWE-284.

Affected Systems

Oracle Reports Developer 12.2.1.19.0 running as part of Oracle Fusion Middleware is affected. Users running this exact version of the product are at risk.

Risk and Exploitability

The CVSS v3.1 Base Score of 9.8 signals a critical risk scenario. Although the EPSS score is less than 1%, indicating a low overall exploitation probability across all systems, any exposed deployment remains an attractive target because the vulnerability is exploitable without initial credential or code injection. The flaw is not listed in the CISA KEV catalog, but the high CVSS score combined with the unauthenticated network access vector warrants urgent attention.

Generated by OpenCVE AI on August 26, 2026 at 23:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle patch or upgrade released in the August 2026 security alert to fix the authentication bypass in Reports Developer 12.2.1.19.0
  • If a patch is not immediately available, restrict inbound TCP traffic to the Reports Developer service using firewall rules or network segmentation so that only trusted hosts can reach the port
  • Enable comprehensive auditing and real‑time monitoring for Reports Developer to quickly detect unauthorized access attempts or anomalous behavior

Generated by OpenCVE AI on August 26, 2026 at 23:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 00:00:00 +0000

Type Values Removed Values Added
Title Authentication Bypass in Oracle Reports Developer Enables Remote Code Execution

Wed, 26 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Wed, 26 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
Title Authentication Bypass in Oracle Reports Developer Enables Remote Code Execution

Tue, 25 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Access Vulnerability Enables Full Compromise of Oracle Reports Developer
Weaknesses CWE-287

Tue, 25 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 11:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Access Vulnerability Enables Full Compromise of Oracle Reports Developer
Weaknesses CWE-287

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 12.2.1.19.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in takeover of Oracle Reports Developer. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle reports Developer
CPEs cpe:2.3:a:oracle:reports_developer:12.2.1.19.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle reports Developer
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Reports Developer
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-25T15:15:32.037Z

Reserved: 2026-07-14T14:54:48.745Z

Link: CVE-2026-62621

cve-icon Vulnrichment

Updated: 2026-08-25T14:37:39.646Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:15.807

Modified: 2026-08-26T17:17:31.920

Link: CVE-2026-62621

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T23:45:03Z

Weaknesses