The Oracle Reports Developer component of Oracle Fusion Middleware contains a weakness that allows an unauthenticated attacker with network access to the HTTP interface to compromise the application. An attacker can trigger the vulnerability and gain full control of Oracle Reports Developer, leading to complete loss of confidentiality, integrity, and availability. The CVSS base score is 9.8, indicating that the vulnerability is catastrophic when exploited.

This weakness exists in Oracle Reports Developer version 14.1.2.0.0. The application is part of Oracle Fusion Middleware and is deployed on enterprise servers that expose the Reports Developer servlet to network traffic. Any installation of the affected version without applying an official fix is vulnerable.

There is no EPSS score available; the vulnerability is not listed in the CISA KEV catalog. However, the CVSS score of 9.8 combined with a network-based attack vector (AV:N) and low attack complexity (AC:L) indicates a high likelihood of exploitation if the application is accessible from the internet. The absence of any authentication requirement (PR:N) and no user interaction (UI:N) make the attack straightforward. The attacker does not need privileged access or a local foothold, merely HTTP connectivity to the exposed Reports Developer instance.