This vulnerability affects Oracle Reports Developer version 12.2.1.19.0 and involves a flaw in the Security and Authentication component. An unauthenticated attacker with network access via SOAP can exploit this vulnerability to gain unauthorized access to critical data or full access to all data accessible by Oracle Reports Developer. Additionally, the attacker can perform unauthorized update, insert, or delete operations on some data and cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, high confidentiality impact, low integrity impact, and low availability impact.

Successful exploitation can result in unauthorized access to critical and all accessible data within Oracle Reports Developer, unauthorized data modification (update, insert, delete) on some data, and partial denial of service affecting availability. This compromises confidentiality, integrity, and availability of the affected system.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the relevant patches promptly. The vendor advisory emphasizes the importance of applying security patches without delay to prevent exploitation. No indication of temporary or alternative mitigations is provided, so patching is the recommended course of action.