CVE-2026-62610
CriticalCVSS 9.1Summary
Vulnerability in Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). Affects version 12.2.1.19.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Reports Developer, leading to unauthorized creation, deletion, or modification of critical data and unauthorized access to all accessible data. CVSS 9.1.
Risk Assessment
The risk is unauthorized modification or access to critical data in Oracle Reports Developer, potentially compromising confidentiality and integrity.
Recommendation
Apply Oracle patches for version 12.2.1.19.0. Restrict network access to the HTTP service to reduce attack surface.
Original NVD description (English source)
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 12.2.1.19.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Reports Developer accessible data as well as unauthorized access to critical data or complete access to all Oracle Reports Developer accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).