This vulnerability affects Oracle Reports Developer version 14.1.2.0.0 and allows an unauthenticated attacker with network access via HTTP to perform unauthorized actions including creation, deletion, or modification of critical data, unauthorized reading of some data, and causing denial of service by hanging or crashing the application. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) reflects network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. Oracle has included this fix in its August 2026 Critical Security Patch Update, which contains numerous security patches across multiple products. The vendor strongly recommends applying patches without delay to prevent exploitation.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical or all accessible data within Oracle Reports Developer, unauthorized read access to some data, and denial of service conditions causing hangs or crashes. This impacts confidentiality, integrity, and availability of the affected system, posing a critical risk to organizations using the vulnerable version.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers should apply the official Oracle patches promptly to remediate this issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.