CVE-2026-70670 is a critical (CVSS 9.6) access control flaw in the Security and Authentication component of Oracle Reports Developer 14.1.2.0.0, reachable over IIOP. An unauthenticated attacker on the adjacent network can take over the product. Oracle's fix is the August 2026 Critical Patch Update.
What's affected
Oracle Reports Developer, part of Oracle Fusion Middleware, version 14.1.2.0.0, which Oracle names as the supported affected version. The component is Security and Authentication, the protocol is IIOP, and the record's description says the weakness can change scope and affect other products.
The weakness is CWE-284, improper access control. The vector is AV:A/AC:L/PR:N/UI:N/S:C: adjacent network, low complexity, no privileges, no user interaction, changed scope, and high impact on confidentiality, integrity and availability. Oracle's risk matrix lists it as remotely exploitable without authentication.
The Oracle security alert page for the August 2026 update is the authority for patch numbers, which depend on your platform.
How to check if you're exposed
Find out whether Oracle Reports Developer 14.1.2.0.0 is installed in any Fusion Middleware home. On the server, the OPatch tool lists installed patches:
$ORACLE_HOME/OPatch/opatch lsinventory
Compare the patch list with the one named in the Oracle August 2026 Critical Patch Update advisory for Oracle Fusion Middleware.
The attack needs adjacent network access, so also check which hosts can reach the IIOP port of the Reports server. If it is open to a broad internal network, close it to the application tier that needs it.
free in-browser dependency scan covers application dependencies. The Oracle middleware patch level comes from OPatch.
What to do now
- Read the Oracle Critical Patch Update advisory for August 2026 and find the Fusion Middleware patch.
- Use OPatch to confirm whether Reports Developer 14.1.2.0.0 is present and what is installed.
- Apply the patch in a test environment, then in production.
- Restrict network access to the Reports server IIOP port to the hosts that need it.
- Disable or remove Reports Developer if you no longer use it.
Why it matters
CWE-284 is a broad class: the system does not correctly limit who can use a function. Here the weakness sits in authentication code and is reachable before login, which is why the privileges required are none.
Two parts of the vector raise the rating. The attack needs no credentials, and the scope change means damage can reach products beyond Reports Developer that share the environment. Network adjacency limits who can attack, but middleware often sits in flat server networks, so segmentation is the control that decides whether this is theoretical.
Quick check
What does adjacent network mean here?
The attacker has to be on the same network segment or a connected shared segment as the server, not anywhere on the internet. Limiting who can reach the IIOP port reduces exposure.
Sources
Last reviewed: 18 October 2026.
