CVE-2026-70673
CriticalCVSS 9.3Summary
Vulnerability in Oracle Reports Developer (component: Security and Authentication) version 14.1.2.0.0. Easily exploitable by an unauthenticated attacker over HTTP, allowing unauthorized data access and modification. Attacks may impact additional products (scope change). CVSS score 9.3.
Risk Assessment
An attacker can gain access to critical data and modify it, and also affect other systems, increasing risk to the entire environment.
Recommendation
Apply Oracle patches and restrict HTTP access to trusted networks only.
Original NVD description (English source)
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Reports Developer. While the vulnerability is in Oracle Reports Developer, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Reports Developer accessible data as well as unauthorized update, insert or delete access to some of Oracle Reports Developer accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).