This vulnerability affects Oracle Reports Developer version 14.1.2.0.0 and is classified under Oracle Fusion Middleware's Security and Authentication component. It allows an unauthenticated attacker with network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Reports Developer. The CVSS 3.1 vector indicates network attack vector with high attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impacts. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability among many others, emphasizing the importance of applying patches promptly. No explicit patch link was provided in the input, but the advisory strongly recommends applying available patches to mitigate such vulnerabilities.

An attacker exploiting this vulnerability can gain unauthorized access to critical data within Oracle Reports Developer, including the ability to create, delete, or modify such data. This compromises the confidentiality and integrity of the data managed by the product. There is no reported impact on availability. The vulnerability requires network access via HTTP but is difficult to exploit and does not require authentication or user interaction.

Oracle includes this vulnerability in its August 2026 Critical Security Patch Update advisory and strongly recommends that customers apply the relevant security patches without delay. Although no direct patch link was provided in the input, users of Oracle Reports Developer version 14.1.2.0.0 should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions. Staying on actively supported versions and promptly applying security updates is the primary mitigation.