This vulnerability affects Oracle Reports Developer version 12.2.1.19.0 and is classified under Oracle Fusion Middleware's Security and Authentication component. It allows an unauthenticated attacker with network access via the Internet Inter-ORB Protocol (IIOP) to compromise the product, potentially resulting in full system takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires no privileges or user interaction and can be performed remotely with low complexity, causing high confidentiality, integrity, and availability impacts. Oracle has included this vulnerability in its August 2026 Critical Security Patch Update, which contains numerous security fixes across Oracle products.

The vulnerability enables an unauthenticated remote attacker to gain complete control over Oracle Reports Developer 12.2.1.19.0, impacting confidentiality, integrity, and availability of the system. This could allow attackers to execute arbitrary code, access sensitive data, and disrupt service operations.

Oracle has released security patches addressing this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches without delay to mitigate the risk. No indication exists that the vulnerability is already mitigated or requires no action. Refer to the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions.