This vulnerability affects Oracle Reports Developer version 14.1.2.0.0 and involves a security flaw in the Security and Authentication component accessible via IIOP. An unauthenticated attacker with network access can exploit this vulnerability to fully compromise the Oracle Reports Developer instance. The CVSS 3.1 vector indicates it requires no privileges or user interaction and has high impact on confidentiality, integrity, and availability. Oracle has published this vulnerability in their August 2026 Critical Security Patch Update advisory, which includes multiple patches across Oracle products. However, no specific patch link for this vulnerability was provided in the input data.

Successful exploitation results in complete takeover of Oracle Reports Developer, impacting confidentiality, integrity, and availability of the affected system. This could allow attackers to execute arbitrary code, access sensitive data, or disrupt service.

Oracle strongly recommends applying the August 2026 Critical Security Patch Update, which addresses this and many other vulnerabilities. Customers should ensure they are running actively supported versions and apply security patches without delay. Since this is not a cloud service, patching must be performed by the customer. Patch status is confirmed by the vendor advisory indicating availability of a critical patch update including this fix.