This vulnerability affects Oracle Reports Developer version 14.1.2.0.0 and is classified under Oracle Fusion Middleware's Security and Authentication component. It enables a low privileged attacker with network access over HTTP to gain unauthorized capabilities to create, delete, modify, or access critical data within Oracle Reports Developer. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. Oracle has published this vulnerability in their August 2026 Critical Security Patch Update advisory but no explicit patch link or fixed version for Oracle Reports Developer 14.1.2.0.0 is provided in the input data.

Successful exploitation allows attackers with low privileges and network access to perform unauthorized creation, deletion, or modification of critical data or gain complete unauthorized access to all data accessible by Oracle Reports Developer. This compromises confidentiality and integrity of sensitive data managed by the product. There is no reported impact on availability. No known exploits in the wild have been reported as of the advisory date.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update program. Although no explicit patch link for Oracle Reports Developer 14.1.2.0.0 is provided in the input data, customers should consult the Oracle August 2026 Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions. Maintaining actively supported versions and timely patch application is critical to mitigate this vulnerability.