This vulnerability affects Oracle Reports Developer version 14.1.2.0.0 within Oracle Fusion Middleware's Security and Authentication component. An attacker with physical network segment access can exploit this flaw without authentication to gain unauthorized access, enabling creation, deletion, or modification of critical data. The vulnerability's scope extends beyond Oracle Reports Developer, potentially affecting other Oracle products. The CVSS vector indicates attack vector as adjacent network (AV:A), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), scope changed (S:C), with high confidentiality (C:H) and integrity (I:H) impacts, and no availability impact (A:N).

Successful exploitation allows unauthorized attackers to create, delete, or modify critical data accessible by Oracle Reports Developer, compromising confidentiality and integrity of data. The vulnerability's scope change means other Oracle products may also be affected, increasing potential impact. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 addressing this and many other vulnerabilities. Customers are strongly advised to apply the relevant patches promptly to affected versions, including Oracle Reports Developer 14.1.2.0.0. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.