This vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated network attackers to gain unauthorized access to critical or all accessible data via TCP. It affects the security and authentication component of Oracle Fusion Middleware. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, with a scope change and high confidentiality impact but no integrity or availability impact. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability among 943 security patches across multiple products. Oracle strongly recommends applying these patches without delay to mitigate exploitation risks.

Successful exploitation results in unauthorized access to critical or all data accessible by Oracle Reports Developer, potentially compromising confidentiality. The vulnerability is exploitable remotely without authentication and requires only network access via TCP. The scope change indicates that other Oracle products may also be affected indirectly. There are no known exploits in the wild at this time.

Oracle has released a Critical Security Patch Update in August 2026 that includes a fix for this vulnerability. Customers should promptly apply the relevant patches from this update to Oracle Reports Developer 12.2.1.19.0 and any other affected products. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No additional mitigation actions are specified by Oracle beyond patching.