This vulnerability affects Oracle Reports Developer version 12.2.1.19.0 and is classified under the Security and Authentication component of Oracle Fusion Middleware. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability is difficult to exploit and has a CVSS 3.1 score of 8.5 with vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating network attack vector, high attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. The vulnerability may also affect other Oracle products due to scope change.

Successful exploitation can result in complete compromise of Oracle Reports Developer, impacting confidentiality, integrity, and availability of the affected system. Additionally, the vulnerability's scope change means other Oracle products could be significantly impacted as a result of attacks targeting this flaw.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the relevant security patches promptly to affected versions. Oracle recommends staying on actively supported versions and applying patches without delay. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.