External risk intelligence

Oracle Reports Developer Security and Authentication Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-70673

Oracle Reports Developer is a specialized component typically deployed within internal middleware or application development environments. While it is network-reachable via HTTP, it is generally not designed or intended to be directly exposed to the public internet in common deployment patterns.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Reports Developer, a component within Oracle Fusion Middleware, that could allow an unauthenticated attacker to gain unauthorized access to sensitive data or modify existing information. While the issue resides in Reports Developer, its impact could extend to other connected products.

Unauthenticated attackers can access or alter sensitive data.
Understand potential impact to connected Oracle products.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could leverage network access to HTTP to reach the Oracle Reports Developer component within Oracle Fusion Middleware. This exposure allows them to interact with the security and authentication features, potentially leading to unauthorized access to or modification of sensitive data.

Attacker starts with network access.
Vulnerability triggered via HTTP.
Risk of unauthorized data access.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access via HTTP could compromise Oracle Reports Developer. When supported by the advisory, successful attacks could lead to unauthorized access to critical data or complete access to all data within Oracle Reports Developer, as well as unauthorized modification, insertion, or deletion of some data.

Critical data or all accessible data.
Network access via HTTP.
Unauthorized access or data modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Oracle Reports Developer component of Oracle Fusion Middleware is vulnerable, potentially impacting other products. Responsibility likely falls to application owners, infrastructure teams, or platform teams managing this middleware. The first practical step involves identifying all instances of Oracle Reports Developer, assessing their network reachability and business criticality, locating the accountable owner, and then planning remediation based on the identified risk.

Application and platform teams own remediation.
Verify instance reachability and criticality.
Plan coordinated vendor and maintenance activities.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Reports Developer?

Oracle Reports Developer is a specialized software component within the Oracle Fusion Middleware suite. Organizations use it to design, develop, and deploy enterprise reporting applications. It serves as a tool for managing complex data output and often acts as a bridge between backend databases and user-facing reporting services within internal middleware environments.

How does CVE-2026-70673 affect security and authentication?

This vulnerability affects the security and authentication mechanisms of the software. It represents a significant weakness where the system fails to properly verify the identity of a requester. Because this control is bypassed, an attacker can interact with the system as if they were an authorized user, potentially viewing or changing sensitive data stored or processed by the application.

What triggers this vulnerability?

The flaw is triggered when an attacker sends specifically crafted HTTP requests to the Oracle Reports Developer component over a network. The vulnerability does not require any prior user authentication, meaning it can be initiated by anyone who can reach the service. Local access or physical proximity to the server is not necessary to trigger the issue.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that while Oracle Reports Developer is network-reachable via HTTP, it is typically deployed within internal middleware or private development environments. It is not generally designed to be exposed directly to the public internet. If your instance is reachable from the outside, the risk level is higher compared to installations restricted to your internal network.

How should I respond to this threat?

Your first step is to inventory all deployments of Oracle Reports Developer across your infrastructure to understand your footprint. Once mapped, verify the network reachability and business criticality of each instance. Coordinate with your application and platform owners to confirm ownership, assess the impact on connected products, and plan necessary maintenance or vendor-provided updates to secure the environment.

References

www.oracle.com/security-alerts/cspuaug2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.