This vulnerability affects Oracle Reports Developer version 12.2.1.19.0 and is classified under Oracle Fusion Middleware's Security and Authentication component. It allows an unauthenticated attacker to exploit the system over HTTP to gain unauthorized access and control over critical data, including creating, deleting, or modifying data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact. Oracle's advisory for the August 2026 Critical Security Patch Update includes this vulnerability among 943 patches, emphasizing the importance of applying updates to mitigate exploitation risks.

Successful exploitation results in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Reports Developer. This compromises confidentiality and integrity of the affected system's data. There is no impact on availability reported. No known exploits in the wild have been reported to date.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the relevant security patches without delay to mitigate the risk. Oracle recommends staying on actively supported versions and promptly applying all security updates. Patch status is confirmed as available through Oracle's Critical Security Patch Update advisory.