Description
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Reports Developer executes to compromise Oracle Reports Developer. While the vulnerability is in Oracle Reports Developer, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Reports Developer. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Published: 2026-08-18
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle Reports Developer version 14.1.2.0.0 contains a flaw in its security and authentication component that permits an attacker with local physical access to the server’s communication segment to compromise the application without authentication. The vulnerability allows a full takeover, impacting confidentiality, integrity, and availability.

Affected Systems

Only Oracle Reports Developer 14.1.2.0.0, part of Oracle Fusion Middleware, is affected. Because the flaw can alter the scope of impact, a successful compromise of Reports Developer may extend to other components that depend on it.

Risk and Exploitability

The CVSS base score of 9.6 signals a critical risk, while the EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not listed in CISA KEV. Attack requires physical proximity to the server’s local network, with no authentication or user interaction after accessing the local interface.

Generated by OpenCVE AI on August 26, 2026 at 18:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch for Reports Developer as announced in the security alert.
  • Monitor Oracle security advisories for updates or published workarounds related to this issue.
  • Restrict physical access to the server’s communication segment by implementing appropriate network segmentation or firewall rules to block the application from adjacent or physically accessible network segments.

Generated by OpenCVE AI on August 26, 2026 at 18:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
Title Local Physical Access Enables Oracle Reports Developer Takeover

Wed, 26 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Wed, 26 Aug 2026 07:15:00 +0000

Type Values Removed Values Added
Title Oracle Reports Developer 14.1.2.0.0 Unauthenticated Local Attack Enables Full Takeover

Wed, 26 Aug 2026 05:00:00 +0000

Type Values Removed Values Added
Title Oracle Reports Developer 14.1.2.0.0 Unauthenticated Local Attack Enables Full Takeover
Weaknesses CWE-286

Tue, 25 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-286

Tue, 25 Aug 2026 20:00:00 +0000

Type Values Removed Values Added
Title Oracle Reports Developer Local Physical Access Allows Application Takeover
Weaknesses CWE-286

Tue, 25 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 13:00:00 +0000

Type Values Removed Values Added
Title Oracle Reports Developer Local Physical Access Allows Application Takeover
Weaknesses CWE-286

Fri, 21 Aug 2026 11:00:00 +0000

Type Values Removed Values Added
Title Unauthorized Physical Network Access Leads to Oracle Reports Developer Takeover
Weaknesses CWE-284

Wed, 19 Aug 2026 11:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Physical Network Access Leads to Oracle Reports Developer Takeover
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Reports Developer executes to compromise Oracle Reports Developer. While the vulnerability is in Oracle Reports Developer, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Reports Developer. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
First Time appeared Oracle
Oracle reports Developer
CPEs cpe:2.3:a:oracle:reports_developer:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle reports Developer
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Oracle Reports Developer
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-25T15:14:22.600Z

Reserved: 2026-08-04T22:06:34.588Z

Link: CVE-2026-70670

cve-icon Vulnrichment

Updated: 2026-08-25T14:25:20.806Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:18.680

Modified: 2026-08-26T17:29:04.203

Link: CVE-2026-70670

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T19:00:07Z

Weaknesses