CVE-2026-62629

Analyzed Analyzed - Analysis Complete

Oracle Reports Developer Unauthenticated Remote Code Execution

Publication date: 2026-08-18

Last updated on: 2026-08-26

Assigner: Oracle

Description

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Reports Developer accessible data as well as unauthorized read access to a subset of Oracle Reports Developer accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Reports Developer. CVSS 3.1 Base Score 9.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-26

Generated

2026-09-09

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-62629

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	reports_developer	14.1.2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Reports Developer, part of Oracle Fusion Middleware. It allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized data access, modification, or deletion, as well as causing the system to crash repeatedly.

Detection Guidance

Detecting this vulnerability requires checking for Oracle Reports Developer version 14.1.2.0.0 running on your network. Use network scanning tools like Nmap to identify hosts with open HTTP ports (typically 80 or 443) and verify if Oracle Reports Developer is installed. Check server logs for unusual HTTP requests targeting Oracle Reports Developer endpoints.

Impact Analysis

If exploited, this vulnerability could allow attackers to access, modify, or delete critical data in Oracle Reports Developer. It may also cause the system to crash repeatedly, leading to downtime and operational disruptions.

Compliance Impact

This vulnerability allows unauthorized access to critical data, modification of data, and denial of service, which could lead to violations of data protection regulations like GDPR and HIPAA. Unauthorized data access or modification may result in non-compliance with confidentiality and integrity requirements under these standards.

Mitigation Strategies

Apply the latest security patches from Oracle immediately. If patches are unavailable, restrict network access to Oracle Reports Developer via firewalls or disable the service if not in use. Monitor for suspicious activity and consider isolating affected systems until mitigation is complete.

Hi! I’m here to help you understand CVE-2026-62629. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70