CVE-2026-62638

Analyzed Analyzed - Analysis Complete

Unauthenticated Remote Code Execution in Oracle Reports Developer

Publication date: 2026-08-18

Last updated on: 2026-08-26

Assigner: Oracle

Description

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Reports Developer accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Reports Developer. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-26

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-62638

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	reports_developer	14.1.2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Reports Developer 14.1.2.0.0 that allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, as well as causing the system to crash repeatedly or hang completely.

Detection Guidance

This vulnerability affects Oracle Reports Developer 14.1.2.0.0 via HTTP. Detection requires checking for exposed instances of this software on your network. Look for open ports 80 or 443 with HTTP services hosting Oracle Reports Developer. Use network scanning tools like nmap to identify Oracle Reports Developer installations. Example command: nmap -p 80,443 --script oracle-reports-info <target_IP>. Check server logs for unusual HTTP requests targeting Oracle Reports Developer endpoints.

Impact Analysis

If exploited, this vulnerability could allow attackers to alter or delete important data, disrupt system availability by causing crashes, and gain unauthorized access to sensitive information within Oracle Reports Developer.

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or deletion, which may violate compliance requirements for GDPR, HIPAA, and other regulations that mandate data integrity and protection.

Mitigation Strategies

Apply the latest security patches from Oracle for Oracle Reports Developer version 14.1.2.0.0. Restrict network access to HTTP ports used by Oracle Reports Developer to trusted sources only. Monitor for unusual activity or crashes in Oracle Reports Developer services.

Hi! I’m here to help you understand CVE-2026-62638. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70