This vulnerability affects Oracle Reports Developer version 12.2.1.19.0, specifically in the Security and Authentication component. An unauthenticated attacker with network access via SMTP can exploit this flaw to gain unauthorized ability to modify data (update, insert, delete) and cause a partial denial of service. The vulnerability has a CVSS 3.1 score of 7.2 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L, indicating network attack vector, low attack complexity, no privileges or user interaction required, scope change, no confidentiality impact, but integrity and availability impacts. Oracle's August 2026 Critical Security Patch Update addresses this and many other vulnerabilities, emphasizing the importance of applying patches promptly.

Exploitation can result in unauthorized modification of data within Oracle Reports Developer and partial denial of service conditions affecting the availability of the product. There is no confidentiality impact reported. The scope change indicates that other Oracle products may also be affected indirectly by this vulnerability.

Oracle has released a Critical Security Patch Update in August 2026 that includes fixes for this vulnerability. Customers are strongly advised to apply the available security patches without delay to mitigate the risk. No alternative mitigations or workarounds are specified in the advisory. Staying on actively supported versions and promptly applying Oracle patches is the recommended course of action.