Description
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Reports Developer accessible data as well as unauthorized update, insert or delete access to some of Oracle Reports Developer accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Reports Developer. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).
Published: 2026-08-18
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle Reports Developer can be compromised through a SOAP interface that does not require authentication. An attacker who can reach the service over the network can read sensitive data and, in some cases, modify or delete records. In addition, the flaw can be abused to disrupt availability by triggering a partial denial of service. The identified weakness discerns the system’s confidentiality, integrity, and availability from an unauthenticated attacker, as reflected in the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L.

Affected Systems

Oracle Reports Developer version 14.1.2.0.0 only. The product is part of Oracle Fusion Middleware and all installations featuring this version are vulnerable until no longer supported by Oracle.

Risk and Exploitability

The CVSS base score of 8.6 classifies this as high severity. EPSS is not available, but the flaw is easily exploitable as it requires no credentials and is reachable over standard SOAP ports. The vulnerability is not listed in the CISA KEV catalog, indicating no known large‑scale exploitation yet, yet the actionable nature of the flaw means it is a clear candidate for immediate mitigation.

Generated by OpenCVE AI on August 19, 2026 at 12:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Block external network access to the SOAP port using firewall rules or ACLs.
  • If possible, enable authentication on the SOAP interface or restrict access to trusted IP addresses.
  • Enable monitoring and logging for SOAP service activity to detect suspicious or abusive requests.

Generated by OpenCVE AI on August 19, 2026 at 12:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 19 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated SOAP Access Enables Unauthorized Data Access and Partial DoS in Oracle Reports Developer Unauthenticated SOAP Access Enables Unauthorized Data Access and Potential Partial Denial of Service in Oracle Reports Developer

Wed, 19 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated SOAP Access Enables Unauthorized Data Access and Partial DoS in Oracle Reports Developer
Weaknesses CWE-200
CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Reports Developer accessible data as well as unauthorized update, insert or delete access to some of Oracle Reports Developer accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Reports Developer. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).
First Time appeared Oracle
Oracle reports Developer
CPEs cpe:2.3:a:oracle:reports_developer:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle reports Developer
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L'}

Subscriptions

Oracle Reports Developer
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-19T12:55:14.517Z

Reserved: 2026-07-14T14:54:48.746Z

Link: CVE-2026-62636

cve-icon Vulnrichment

Updated: 2026-08-19T12:11:58.759Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:17.500

Modified: 2026-08-20T15:04:21.943

Link: CVE-2026-62636

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-19T12:15:03Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control