This vulnerability affects Oracle Reports Developer version 14.1.2.0.0 within Oracle Fusion Middleware's Security and Authentication component. An attacker who can access the physical communication segment attached to the hardware where Oracle Reports Developer runs can exploit this flaw without authentication. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates the attack requires adjacent network access but no privileges or user interaction, and can fully compromise confidentiality, integrity, and availability of the product. The vendor advisory references a Critical Security Patch Update but does not explicitly confirm a patch for this specific CVE. Oracle strongly recommends applying available patches promptly to mitigate vulnerabilities.

Successful exploitation results in complete compromise of Oracle Reports Developer, impacting confidentiality, integrity, and availability. An unauthenticated attacker with physical network segment access can take over the product, potentially allowing full control over its functions and data.

Oracle has released a Critical Security Patch Update in August 2026 containing numerous fixes. Customers are strongly advised to remain on actively supported versions and apply Oracle's security patches without delay. The vendor advisory does not explicitly confirm a patch for CVE-2026-62631 but recommends applying all relevant updates from the Critical Security Patch Update. Patch status for this specific vulnerability is not explicitly confirmed; users should consult the Oracle advisory for current remediation guidance.