CVE-2026-70673 in Reports Developer
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Reports Developer. While the vulnerability is in Oracle Reports Developer, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Reports Developer accessible data as well as unauthorized update, insert or delete access to some of Oracle Reports Developer accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Oracle Reports Developer component of Oracle Fusion Middleware, specifically affecting version 14.1.2.0.0 under the Security and Authentication module. This flaw represents a critical security deficiency that permits unauthenticated attackers to compromise the integrity and confidentiality of the system through network access via HTTP. The severity of this issue is underscored by its high exploitability rating, indicating that no user interaction or complex conditions are required for an attacker to leverage it effectively against vulnerable instances exposed on the network.
From a technical perspective, the root cause lies in insufficient authentication controls within the Oracle Reports Developer interface. This allows remote actors who possess basic network connectivity to bypass security mechanisms designed to restrict access to sensitive administrative functions and data repositories. The vulnerability aligns with CWE-287, which describes Improper Authentication, as well as CWE-306, Missing Authentication for Critical Function, highlighting a fundamental failure in the application's ability to verify the identity of users attempting to perform privileged operations. Because the attack vector is network-based and requires no local access or user interface interaction, it falls squarely into the ATT&CK technique T1190, Exploit Public-Facing Application, which covers attacks targeting services like web servers that are accessible from external networks.
The operational impact of this vulnerability extends beyond the immediate Oracle Reports Developer environment due to a scope change phenomenon where successful exploitation can significantly affect additional products within the broader Fusion Middleware ecosystem. An attacker who successfully exploits this flaw gains unauthorized access to critical data, potentially leading to severe confidentiality breaches involving proprietary information or sensitive user records. Furthermore, the integrity impact is substantial, as the vulnerability grants attackers the ability to perform unauthorized updates, inserts, and deletes on accessible Oracle Reports Developer data. This capability allows for the modification or destruction of essential configuration files, report definitions, and underlying database contents, which can disrupt business operations and lead to significant financial and reputational damage.
The CVSS 3.1 Base Score of 9.3 reflects a Critical severity level, driven primarily by high impacts on Confidentiality and Integrity with no impact on Availability in the base metrics. The vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) confirms that while availability is not directly compromised, the scope change indicates that collateral damage to other connected systems may occur during exploitation. This suggests a potential for lateral movement or cascading failures within integrated enterprise environments where Oracle Reports Developer interacts with databases and other middleware components.
To mitigate this risk, organizations must immediately apply the latest security patches provided by Oracle for version 14.1.2.0.0 of Fusion Middleware. It is imperative to verify that all instances are updated to a patched release that addresses these authentication flaws. In addition to patching, network segmentation strategies should be employed to restrict HTTP access to Oracle Reports Developer interfaces from untrusted networks. Implementing strict firewall rules and Web Application Firewalls can help block unauthorized requests before they reach the vulnerable application layer. Regular security audits and penetration testing focused on authentication bypasses are also recommended to ensure that no residual vulnerabilities remain in the deployment environment.