This vulnerability affects Oracle Reports Developer version 12.2.1.19.0 and allows an unauthenticated attacker to gain unauthorized access to critical data via network access over HTTP. The vulnerability impacts confidentiality with no required privileges or user interaction and has a scope change that may affect other Oracle products. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, reflecting network attack vector, low complexity, no privileges or user interaction required, scope changed, and high confidentiality impact without integrity or availability impact. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability among 943 patches across multiple products.

Exploitation of this vulnerability can result in unauthorized access to critical or all data accessible through Oracle Reports Developer. The confidentiality of sensitive information is at high risk. There is no impact on integrity or availability according to the CVSS vector. The vulnerability's scope change indicates potential impact on other Oracle products, increasing the risk footprint.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying patches without delay. No additional mitigation steps are specified beyond patching.