This vulnerability affects Oracle Reports Developer version 14.1.2.0.0 and allows an unauthenticated attacker with network access via HTTP to compromise the product. The attack can result in unauthorized access to critical data and unauthorized modification (update, insert, delete) of some accessible data. The vulnerability has a scope change, meaning it may affect additional Oracle products beyond Oracle Reports Developer. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, scope changed, high confidentiality impact, low integrity impact, and no availability impact.

Exploitation can lead to unauthorized access to all data accessible by Oracle Reports Developer and unauthorized modification of some of that data. This compromises confidentiality and integrity of the affected system's data. The vulnerability's scope change means other Oracle products may also be impacted, increasing the potential damage.

Oracle has released security patches addressing this vulnerability as part of their August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly. Oracle recommends remaining on actively-supported versions and applying security patches without delay to mitigate exploitation risks.