Description
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Reports Developer accessible data as well as unauthorized access to critical data or complete access to all Oracle Reports Developer accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-08-18
Score: 7.4 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in Oracle Reports Developer version 14.1.2.0.0 permits an attacker who can reach the service over HTTP to perform unauthorized creation, deletion or modification of data and to access all data stored in the application. This results in confidentiality and integrity impacts because the attacker can modify or exfiltrate information without logging in. The underlying weakness is a weakness in access control (CWE‑284).

Affected Systems

The vulnerability affects Oracle Reports Developer 14.1.2.0.0, a component of Oracle Fusion Middleware. No other versions are noted as vulnerable in the available data.

Risk and Exploitability

The CVSS 3.1 base score of 7.4 indicates high severity, while the EPSS score is < 1% and the issue is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is network access via HTTP, with no user interaction required. An exploitable instance therefore poses a high risk of data tampering or unauthorized data exposure to any host exposing Oracle Reports Developer to the Internet.

Generated by OpenCVE AI on August 26, 2026 at 18:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any official Oracle product update or patch that addresses the vulnerability in Reports Developer 14.1.2.0.0.
  • Limit exposure by restricting HTTP access to trusted networks, or enable HTTPS and enforce strong authentication where possible.
  • Review and tighten configuration to ensure that only authorized users can create, modify or delete data, and consider disabling any default or unused accounts.

Generated by OpenCVE AI on August 26, 2026 at 18:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
Title Oracle Reports Developer Unauthenticated Remote Access Vulnerability

Wed, 26 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Tue, 25 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 11:15:00 +0000

Type Values Removed Values Added
Title Oracle Reports Developer Unauthenticated Remote Access Vulnerability
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Reports Developer accessible data as well as unauthorized access to critical data or complete access to all Oracle Reports Developer accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle reports Developer
CPEs cpe:2.3:a:oracle:reports_developer:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle reports Developer
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Reports Developer
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-25T15:14:07.860Z

Reserved: 2026-08-04T22:06:34.588Z

Link: CVE-2026-70672

cve-icon Vulnrichment

Updated: 2026-08-25T14:25:24.887Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:18.927

Modified: 2026-08-26T17:29:17.493

Link: CVE-2026-70672

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T19:00:07Z

Weaknesses