A vulnerability in Oracle Reports Developer 14.1.2.0.0 allows an unauthenticated attacker who has access to the physical communication segment attached to the hardware where the product runs to take over the application. The weakness is an improper authentication flaw that lets the attacker bypass all credential checks, leading to confidentiality, integrity, and availability compromise. Successful exploitation results in full control over Oracle Reports Developer and allows the attacker to execute arbitrary code on the host system.

Oracle Reports Developer 14.1.2.0.0, part of Oracle Fusion Middleware, is affected. The vulnerability applies to installations of this specific version of the product and no other versions are mentioned.

The CVSS score of 8.8 indicates severe impact; however, the exploit requires physical proximity or access to the local network segment connected to the server, which limits the attack surface. EPSS data is not available, so the exact exploitation probability cannot be quantified, but the absence from the CISA KEV catalog suggests there are no known public exploits yet. Nevertheless, because the flaw completely bypasses authentication, the risk to any deployment that is not isolated from physical or local network access is high.