CVE-2026-62637 is a critical (CVSS 9.3) access control flaw in Oracle Reports Developer 14.1.2.0.0, part of Oracle Fusion Middleware. An unauthenticated attacker on the same network segment can compromise the product over CORBA. Apply the patch from Oracle's August 2026 Critical Security Patch Update.
What's affected
Oracle's August 2026 advisory lists Oracle Reports Developer, component Security and Authentication, with supported version 14.1.2.0.0 affected. The protocol is CORBA, no authentication is required, and the score is 9.3 with a changed scope. The weakness is CWE-284 (improper access control).
Oracle's description says the vulnerability is easily exploitable by an unauthenticated attacker with access to the physical communication segment where the product runs, and that attacks may significantly impact additional products. Confidentiality and integrity impacts are high; availability is not affected.
The record and Oracle's risk matrix agree on the score and on the version. This CVE has a sibling for the other supported release: 12.2.1.19.0. If you run both lines, you need both fixes.
How to check if you're exposed
Confirm whether Oracle Reports Developer is installed and which release.
$ORACLE_HOME/OPatch/opatch lsinventory | grep -i reports
Then check whether the CORBA service for Reports Developer is reachable from other hosts on the same network segment. The vector is adjacent network, so exposure depends on who shares the segment with the server, not on internet reachability. Compare your installed patch level with the August 2026 CPU patch availability document for Fusion Middleware.
Whatever the product, a current inventory of what you run is what turns a CVE notice into a quick answer. The Gold page for this CVE tracks how its record changes over time, and the free in-browser dependency scan at gold.safeguard.sh/scan covers the application libraries you ship.
What to do now
- Use opatch lsinventory to find every Oracle Reports Developer home and its version.
- Open Oracle's August 2026 Critical Security Patch Update advisory and the patch availability document for Fusion Middleware, then apply the listed patch to each affected home.
- Restrict network access to the Reports Developer CORBA ports to the hosts that need them, using host or network firewalls.
- Review which systems share a network segment with the server, and treat unmanaged devices on that segment as in scope.
- Record the patch in your change log and rerun opatch to confirm it applied.
Why it matters
An access control flaw means the product lets someone do something they should have been refused. Here the attacker needs no credentials, only a position on the same segment. Many internal servers were designed on the assumption that the local network is trusted; this CVE is a reminder that the assumption deserves a second look.
The scope change in the score matters: compromise of Reports Developer can affect other components. That is why the base score reaches the critical band even though the attacker must be adjacent. The record does not list the CVE as exploited in the wild and it is not in CISA KEV.
Quick check
Can this be exploited from the internet?
The vector is adjacent network, meaning the attacker needs access to the same network segment. A server reachable only through a firewall is less exposed, but flat internal networks and shared segments widen the risk.
Sources
Last reviewed: 18 October 2026.
