This vulnerability affects Oracle Reports Developer version 14.1.2.0.0 and allows an unauthenticated attacker with network access via SOAP to compromise the application. Successful exploitation can result in unauthorized access to all accessible data, unauthorized update, insert, or delete operations on some data, and the ability to cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact with lower integrity and availability impacts. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability. No known exploits in the wild have been reported.

An attacker can gain unauthorized access to critical data or full data accessible by Oracle Reports Developer, perform unauthorized modifications to some data, and cause a partial denial of service affecting availability. This compromises confidentiality, integrity, and availability of the affected system.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Users of Oracle Reports Developer 14.1.2.0.0 should apply the official patch from Oracle without delay to remediate this issue. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches. No alternative mitigations or workarounds are specified in the advisory.