This vulnerability affects Oracle Reports Developer version 12.2.1.19.0 within Oracle Fusion Middleware's Security and Authentication component. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially gaining unauthorized access to critical data and the ability to update, insert, or delete some accessible data. The vulnerability is difficult to exploit and has a CVSS 3.1 base score of 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N), indicating network attack vector, high attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. While the vulnerability is in Oracle Reports Developer, successful exploitation may significantly impact other Oracle products as well.

Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible by Oracle Reports Developer. It also allows unauthorized update, insert, or delete operations on some accessible data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope of impact may extend beyond Oracle Reports Developer to other Oracle products.

The vendor advisory does not explicitly state the availability of a patch or temporary fix for this specific vulnerability. Oracle strongly recommends that customers remain on actively-supported versions and apply all available security patches without delay. Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance.