Description
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 12.2.1.19.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in takeover of Oracle Reports Developer. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An unauthenticated flaw in Oracle Reports Developer permits an attacker with network access to the IIOP interface to execute arbitrary code, allowing full compromise of the application and severe impacts on confidentiality, integrity, and availability.

Affected Systems

Oracle Reports Developer version 12.2.1.19.0, part of Oracle Fusion Middleware, is affected. The product is provided by Oracle Corporation.

Risk and Exploitability

The CVSS Base Score of 9.8 indicates a critical severity with high impacts on confidentiality, integrity, and availability. The EPSS score of < 1% reflects a very low probability of exploitation in the broader ecosystem. However, the vulnerability does not require authentication and is reachable via the network IIOP interface. If an attacker succeeds, they would gain full control over the Oracle Reports Developer instance. The vulnerability is not listed in CISA KEV, and no public exploit is currently documented.

Generated by OpenCVE AI on August 26, 2026 at 04:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch or upgrade Oracle Reports Developer to a version that includes the IIOP authentication fix.
  • If an immediate patch is not available, restrict IIOP exposure by configuring firewall rules or subnet restrictions so that only trusted hosts can access the IIOP interface.
  • Disable IIOP or enforce stronger authentication such as TLS/SSL for any remaining connections, and monitor logs for anomalous IIOP activity.

Generated by OpenCVE AI on August 26, 2026 at 04:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 05:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Exploit Enables Full Compromise of Oracle Reports Developer via IIOP

Tue, 25 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Unauthenticated IIOP Access in Oracle Reports Developer
Weaknesses CWE-287

Tue, 25 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 09:30:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Unauthenticated IIOP Access in Oracle Reports Developer
Weaknesses CWE-287

Wed, 19 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Title Oracle Reports Developer Unauthenticated IIOP Remote Code Execution Vulnerability
Weaknesses CWE-284

Wed, 19 Aug 2026 02:00:00 +0000

Type Values Removed Values Added
Title Oracle Reports Developer Unauthenticated IIOP Remote Code Execution Vulnerability
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 12.2.1.19.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in takeover of Oracle Reports Developer. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle reports Developer
CPEs cpe:2.3:a:oracle:reports_developer:12.2.1.19.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle reports Developer
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Reports Developer
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-25T15:15:00.293Z

Reserved: 2026-07-14T14:54:48.745Z

Link: CVE-2026-62624

cve-icon Vulnrichment

Updated: 2026-08-25T14:37:44.423Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:16.143

Modified: 2026-08-26T17:17:49.460

Link: CVE-2026-62624

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T04:45:05Z

Weaknesses