This vulnerability exists in Oracle Reports Developer, a component of Oracle Fusion Middleware's Security and Authentication. It is exploitable remotely over the network by an attacker with low privileges via the CORBA protocol. The vulnerability can lead to complete compromise of Oracle Reports Developer, with potential impact extending to other Oracle products. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. The affected version explicitly stated is 12.2.1.19.0.

Successful exploitation allows an attacker to take over Oracle Reports Developer, potentially leading to full control over the affected system. The vulnerability impacts confidentiality, integrity, and availability at a high level. Additionally, due to scope change, other Oracle products may be significantly impacted by attacks exploiting this vulnerability.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively-supported versions and applying patches without delay. Patch status is confirmed as available via Oracle's official advisory.