CVE-2026-70673

Received Received - Intake

Oracle Reports Developer Unauthorized Data Access Vulnerability

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: Oracle

Description

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Reports Developer. While the vulnerability is in Oracle Reports Developer, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Reports Developer accessible data as well as unauthorized update, insert or delete access to some of Oracle Reports Developer accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-08-19

EPSS Evaluated

N/A

NVD

CVE-2026-70673

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	reports_developer	14.1.2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Reports Developer 14.1.2.0.0 that allows unauthenticated attackers to remotely access the system via HTTP. It can lead to unauthorized access to critical data or full data compromise, including the ability to modify some data.

Detection Guidance

Detection requires checking for Oracle Reports Developer version 14.1.2.0.0 and verifying network exposure via HTTP. Inspect running services and open ports 80/443 for Oracle Reports Developer endpoints. Use network scanning tools like Nmap to identify Oracle Reports Developer instances.

Impact Analysis

An attacker could exploit this to steal sensitive data, alter records, or gain control over Oracle Reports Developer. Since attacks may affect other products, the impact could extend beyond the initial system.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data security) requirements. Non-compliance may result in legal penalties or reputational damage.

Mitigation Strategies

Immediately restrict network access to Oracle Reports Developer via firewalls or disable HTTP access if not required. Apply Oracle's security patches if available. Monitor for unauthorized access attempts and consider isolating affected systems until mitigation is complete.

Hi! I’m here to help you understand CVE-2026-70673. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70