Description
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Reports Developer accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Reports Developer. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
Published: 2026-08-18
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A network‑based vulnerability exists in Oracle Reports Developer 14.1.2.0.0 that permits an unauthenticated attacker to create, delete, or modify data accessible through the application and to cause an application hang or crash. The flaw undermines the integrity of reports data and the availability of the service, allowing the attacker to disrupt normal business operations. The reported weakness results in a CVSS v3.1 score of 9.1.

Affected Systems

This issue affects Oracle Reports Developer 14.1.2.0.0, a component of Oracle Fusion Middleware’s Security and Authentication suite. The product is distributed by Oracle Corporation under the OEM name Oracle Reports Developer.

Risk and Exploitability

The CVSS score of 9.1 indicates severe impact on integrity and availability, and the vulnerability is described as easy to exploit. The EPSS score is less than 1% and the vulnerability is not yet listed in the CISA KEV catalog, indicating a low probability of exploitation given the low EPSS score, but the ease of exploit and lack of prerequisites still make it a real threat for organizations that expose Oracle Reports Developer to network traffic. Exploit conditions do not require any prior privileges or specialized knowledge, making the threat real for organizations that expose Oracle Reports Developer to network traffic.

Generated by OpenCVE AI on August 26, 2026 at 23:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch for Reports Developer 14.1.2.0.0 or upgrade to a version that includes the fix.
  • Restrict network access to the Reports Developer service by implementing firewalls or VPNs, ensuring only trusted hosts can reach the HTTP interface.
  • Enforce strict access control policies on the application and regularly audit logs for unauthorized data modification or service interruption attempts.

Generated by OpenCVE AI on August 26, 2026 at 23:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 22:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote HTTP Vulnerability Allowing Data Tampering and Denial of Service in Oracle Reports Developer
Weaknesses CWE-400

Wed, 26 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Tue, 25 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote HTTP Vulnerability Allowing Data Tampering and Denial of Service in Oracle Reports Developer
Weaknesses CWE-284
CWE-400

Fri, 21 Aug 2026 08:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Data Tampering and Denial of Service in Oracle Reports Developer
Weaknesses CWE-284

Wed, 19 Aug 2026 02:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Data Tampering and Denial of Service in Oracle Reports Developer
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Reports Developer accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Reports Developer. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
First Time appeared Oracle
Oracle reports Developer
CPEs cpe:2.3:a:oracle:reports_developer:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle reports Developer
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

Oracle Reports Developer
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-25T16:22:44.126Z

Reserved: 2026-07-14T14:54:48.746Z

Link: CVE-2026-62638

cve-icon Vulnrichment

Updated: 2026-08-25T16:20:59.992Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:17.740

Modified: 2026-08-26T17:28:13.037

Link: CVE-2026-62638

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T23:30:12Z

Weaknesses