CVE-2026-62636

Received Received - Intake

Oracle Reports Developer Unauthenticated SOAP Access Vulnerability

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: Oracle

Description

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Reports Developer accessible data as well as unauthorized update, insert or delete access to some of Oracle Reports Developer accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Reports Developer. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-08-19

EPSS Evaluated

N/A

NVD

CVE-2026-62636

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	reports_developer	14.1.2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Reports Developer (part of Oracle Fusion Middleware) version 14.1.2.0.0. It allows an unauthenticated attacker to remotely exploit the system via SOAP requests. Successful exploitation can lead to unauthorized access to sensitive data, modification of data, or partial disruption of service.

Detection Guidance

Detect this vulnerability by checking for Oracle Reports Developer version 14.1.2.0.0. Inspect network traffic for SOAP requests to Oracle Reports Developer services. Verify if unauthenticated access is possible via network access.

Impact Analysis

If you use Oracle Reports Developer, an attacker could steal or alter critical data, delete or insert unauthorized records, or cause service disruptions. This could lead to data breaches, financial loss, or operational downtime.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Apply Oracle's security patches for Oracle Reports Developer 14.1.2.0.0 immediately. Restrict network access to Oracle Reports Developer services via firewall rules. Disable SOAP access if not required. Monitor for unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-62636. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70