CVE-2026-70675: Oracle Reports Developer Auth Bypass Flaw

CVE-2026-70675 Overview

CVE-2026-70675 affects Oracle Reports Developer, a component of Oracle Fusion Middleware. The vulnerability resides in the Security and Authentication component of version 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Reports Developer, resulting in full product takeover.

Oracle published details in the Oracle Security Alert Advisory - cspuaug2026. While the attack complexity is high, successful exploitation impacts confidentiality, integrity, and availability. The vulnerability was published to the National Vulnerability Database (NVD) on August 18, 2026.

Critical Impact
Successful exploitation allows an unauthenticated remote attacker to take over Oracle Reports Developer, compromising confidentiality, integrity, and availability of the affected instance.

Affected Products

Oracle Fusion Middleware — Oracle Reports Developer
Affected version: 14.1.2.0.0
Component: Security and Authentication

Discovery Timeline

2026-08-18 - CVE-2026-70675 published to NVD
2026-08-20 - Last updated in NVD database
2026-08-20 - EPSS score recorded at 0.404% (percentile 33.85)

Technical Details for CVE-2026-70675

Vulnerability Analysis

The vulnerability exists in the Security and Authentication component of Oracle Reports Developer. An attacker reaches the affected code path over HTTP without any credentials or user interaction. Successful exploitation yields full product takeover, meaning the attacker can read, modify, and disrupt reporting operations.

Oracle classifies the attack complexity as high, indicating that exploitation depends on conditions outside the attacker's direct control. This typically involves specific timing, configuration, or environmental prerequisites. Once those conditions are met, the impact spans all three security properties.

Oracle has not published detailed technical internals for CVE-2026-70675. Administrators should consult the Oracle Security Alert Advisory for authoritative patch mapping.

Root Cause

The root cause resides in the Security and Authentication component of Oracle Reports Developer 14.1.2.0.0. Oracle has not disclosed the underlying weakness class or CWE identifier in the public advisory. The scope remains unchanged during exploitation, which indicates the compromise is contained within the vulnerable component's security authority.

Attack Vector

The attack vector is network-based over HTTP. An unauthenticated remote attacker sends crafted HTTP traffic to an exposed Oracle Reports Developer instance. No user interaction is required. Instances directly reachable from the internet or from untrusted network segments face the highest exposure.

No public proof-of-concept or exploit code has been observed at the time of publication. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-70675

Indicators of Compromise

Unexpected HTTP requests targeting Oracle Reports Developer endpoints from external or unusual internal sources.
Anomalous authentication events or session establishment against the Reports Developer service without corresponding valid user activity.
New or modified report definitions, output files, or scheduled jobs that do not map to authorized administrative changes.
Outbound connections from the Oracle Reports Developer host to unfamiliar destinations following inbound HTTP traffic.

Detection Strategies

Deploy web application firewall (WAF) rules that log and inspect HTTP requests to Oracle Reports Developer URIs.
Correlate authentication logs from Oracle Fusion Middleware with network flow data to identify unauthenticated access attempts.
Baseline expected administrative activity on Reports Developer and alert on deviations, particularly outside change windows.
Enable Oracle Fusion Middleware audit logging for the Security and Authentication component and forward logs to a central SIEM.

Monitoring Recommendations

Ingest Oracle Fusion Middleware, WAF, and network telemetry into a central data lake for cross-source correlation.
Monitor process creation, file writes, and outbound network activity on hosts running Oracle Reports Developer.
Track patch state of Fusion Middleware components in asset inventory and alert on hosts still running version 14.1.2.0.0 post-advisory.

How to Mitigate CVE-2026-70675

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert Advisory - cspuaug2026 to all Oracle Reports Developer 14.1.2.0.0 instances.
Inventory every deployment of Oracle Fusion Middleware and confirm which hosts run the affected component.
Restrict inbound HTTP access to Oracle Reports Developer to trusted management networks until patches are applied.
Review authentication and access logs since the earliest exposure date for unexplained activity.

Patch Information

Oracle addressed CVE-2026-70675 in the security alert published on the Oracle Security Alerts page for cspuaug2026. Administrators must consult the advisory to identify the correct patch bundle for Oracle Fusion Middleware 14.1.2.0.0 and apply it following Oracle's standard patching procedure.

Workarounds

Place Oracle Reports Developer behind a reverse proxy or WAF that enforces authentication and IP allow-listing.
Disable or block network exposure of the Reports Developer service if it is not required for production use.
Enforce network segmentation so only application servers and administrators can reach the service over HTTP.
Require VPN or zero-trust network access for all administrative interactions with Oracle Fusion Middleware components.

bash

# Example: restrict inbound HTTP to Oracle Reports Developer via iptables
# Replace <trusted_cidr> and <reports_port> with your environment values
iptables -A INPUT -p tcp --dport <reports_port> -s <trusted_cidr> -j ACCEPT
iptables -A INPUT -p tcp --dport <reports_port> -j DROP