This vulnerability affects Oracle Reports Developer version 12.2.1.19.0 within Oracle Fusion Middleware's Security and Authentication component. An attacker with physical access to the communication segment connected to the hardware running Oracle Reports Developer can exploit this flaw without authentication. Exploitation may result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Reports Developer. The vulnerability's scope change indicates potential impact on other Oracle products. The CVSS vector is AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, indicating network attack via adjacent network, low attack complexity, no privileges or user interaction required, with high confidentiality and integrity impact and no availability impact.

The vulnerability allows unauthorized attackers with physical network access to compromise Oracle Reports Developer, leading to unauthorized creation, deletion, or modification of critical data. The impact extends beyond Oracle Reports Developer due to scope change, potentially affecting other Oracle products. Confidentiality and integrity of data are severely impacted, but availability is not affected.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the relevant security patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying all security patches without delay. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. No alternative mitigations or workarounds are specified.