This vulnerability affects Oracle Reports Developer version 14.1.2.0.0 within Oracle Fusion Middleware's Security and Authentication component. An unauthenticated attacker with physical network segment access can exploit this flaw to compromise the Oracle Reports Developer instance, potentially leading to complete takeover. The vulnerability's scope extends beyond Oracle Reports Developer, possibly affecting other Oracle products. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects an attack vector requiring adjacent network access but no privileges or user interaction, with critical impacts on confidentiality, integrity, and availability.

Successful exploitation results in complete compromise of Oracle Reports Developer, including full confidentiality, integrity, and availability loss. The vulnerability's scope change means that other Oracle products may also be significantly impacted. The attack requires physical access to the communication segment attached to the hardware running the vulnerable software.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the relevant security patches promptly to affected Oracle products, including Oracle Reports Developer 14.1.2.0.0. Oracle emphasizes remaining on actively supported versions and applying patches without delay. No alternative mitigations or temporary fixes are indicated in the advisory.