This vulnerability affects Oracle Reports Developer version 12.2.1.19.0 within Oracle Fusion Middleware's Security and Authentication component. It allows an unauthenticated attacker with network access via the Internet Inter-ORB Protocol (IIOP) to compromise the product, potentially resulting in full system takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires no privileges or user interaction and can be executed remotely with low complexity. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability, emphasizing the importance of patching to prevent exploitation.

The vulnerability enables unauthenticated remote attackers to gain full control over Oracle Reports Developer, impacting confidentiality, integrity, and availability of the affected system. This could lead to unauthorized data access, modification, and service disruption. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Users of Oracle Reports Developer 12.2.1.19.0 should apply the official patch from Oracle without delay. Oracle strongly recommends remaining on actively-supported versions and promptly applying security patches to mitigate this and other vulnerabilities. No alternative mitigations or workarounds are indicated in the advisory.