This vulnerability affects Oracle Reports Developer version 14.1.2.0.0 and is classified under Oracle Fusion Middleware's Security and Authentication component. It permits an unauthenticated attacker who has physical network segment access to compromise the Oracle Reports Developer instance. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. The attack vector requires adjacent network access (AV:A), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N). Oracle has published a Critical Security Patch Update (August 2026) that addresses this and many other vulnerabilities, strongly recommending patch application.

Exploitation of this vulnerability can result in complete takeover of Oracle Reports Developer, leading to full compromise of confidentiality, integrity, and availability of the affected system. The attacker does not require authentication but must have access to the physical communication segment attached to the hardware running the software.

Oracle has released a Critical Security Patch Update in August 2026 that includes fixes for this vulnerability. Customers are strongly advised to apply the available patches promptly to mitigate the risk. No alternative mitigations or workarounds are specified. Staying on actively supported versions and applying Oracle patches without delay is recommended.