CVE-2026-62629 in Reports Developer
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Reports Developer accessible data as well as unauthorized read access to a subset of Oracle Reports Developer accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Reports Developer. CVSS 3.1 Base Score 9.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Security and Authentication component of Oracle Reports Developer, specifically affecting version 14.1.2.0.0 which is part of the broader Oracle Fusion Middleware suite. This flaw represents a critical security deficiency that fundamentally undermines the integrity of the application's access control mechanisms. The nature of this weakness allows for exploitation by an unauthenticated attacker who requires only network access via HTTP to initiate successful attacks. Because no prior authentication or user interaction is necessary, the barrier to entry for malicious actors is significantly lowered, making this a high-risk vulnerability that can be leveraged remotely over standard web protocols without requiring social engineering or complex setup procedures from the adversary's perspective.
From a technical standpoint, the flaw enables unauthorized creation, deletion, and modification of critical data within the Oracle Reports Developer environment. This indicates a severe breakdown in authorization controls where the system fails to properly validate whether an incoming request originates from a legitimate, authenticated user with appropriate privileges before executing sensitive operations. Consequently, attackers can alter or destroy essential configuration files, report definitions, or underlying database records that drive the reporting infrastructure. Additionally, the vulnerability grants unauthorized read access to a subset of accessible data, suggesting that while full administrative control might be contingent on specific conditions, basic information disclosure is reliably achievable through this exploit vector.
The operational impact of exploiting this vulnerability extends beyond mere data compromise to include significant disruptions in service availability. Successful exploitation can lead to a complete denial of service by causing the Oracle Reports Developer application to hang or experience frequent, repeatable crashes. This capability allows an attacker to effectively take down critical reporting services, impacting business operations that rely on timely and accurate report generation. The combination of data integrity loss, confidentiality breaches, and availability disruption results in a high severity rating with a CVSS 3.1 Base Score of 9.4. This score reflects the substantial impact across all three pillars of the CIA triad: Confidentiality is compromised through unauthorized data reads; Integrity is violated via unapproved modifications or deletions; and Availability is severely impacted by the potential for application crashes and hangs.
In terms of industry standard classifications, this vulnerability aligns with CWE-287 Improper Authentication as it allows access without proper verification of identity, and likely involves CWE-269 Improper Privilege Management if the attacker gains elevated capabilities beyond their intended scope. The attack vector corresponds to MITRE ATT&CK techniques such as T1078 Valid Accounts or potentially T1133 External Remote Services depending on how the unauthenticated access is initially established, though the lack of authentication requirement suggests a flaw in the initial request handling rather than credential theft. To mitigate this risk, immediate patching to the latest available version of Oracle Reports Developer and Fusion Middleware components is essential as these updates typically contain fixes for such critical security flaws. Organizations should also implement network-level controls such as web application firewalls to restrict HTTP access to trusted IP ranges until patches are applied, thereby reducing the attack surface exposed to unauthenticated remote attackers.