This vulnerability affects Oracle Reports Developer version 14.1.2.0.0 and is classified under Oracle Fusion Middleware's Security and Authentication component. It permits unauthenticated remote attackers to perform unauthorized data manipulation and cause repeated application crashes resulting in denial of service. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality impact, but high integrity and availability impacts. The vendor advisory references a Critical Security Patch Update released in August 2026, which includes patches for this and many other vulnerabilities.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical or all accessible data within Oracle Reports Developer, as well as the ability to cause a hang or frequent crashes leading to complete denial of service. There is no confidentiality impact reported. The vulnerability is easily exploitable remotely without authentication.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches promptly to mitigate this issue. No indication is given that the vulnerability is already mitigated or requires no action. Since this is not a cloud service, patching must be applied by the customer. Refer to the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for detailed patch availability and installation instructions.