This vulnerability affects Oracle Reports Developer version 14.1.2.0.0 and involves a security flaw in the Security and Authentication component of Oracle Fusion Middleware. An attacker without any privileges can exploit this vulnerability remotely over the network via SOAP to gain unauthorized access and perform unauthorized data manipulation or access. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Reports Developer. This compromises confidentiality and integrity of sensitive information managed by the product, potentially leading to significant data breaches or data tampering.

Oracle has released a Critical Security Patch Update in August 2026 addressing multiple vulnerabilities including this one. Customers are strongly advised to apply the latest security patches promptly and remain on actively supported versions. The vendor advisory does not explicitly confirm a patch for version 14.1.2.0.0, so users should consult the Oracle advisory for the latest patch availability and installation instructions. No alternative mitigations or workarounds are specified in the advisory.