Oracle JDeveloper CVE-2026-60345

Exploitation requires an authenticated high-privileged attacker (CVSS PR:H) with network HTTP access to the Oracle JDeveloper ADF Shared Components component; the attacker must already hold elevated privileges within the product, which is the primary limiting factor. The attack is low-complexity (AC:L) and needs no user interaction (UI:N), but it is gated behind existing high-privilege access, so it is not exploitable by an unauthenticated or low-privileged remote attacker against a default deployment. Only supported versions 12.2.1.4.0 and 14.1.2.0.0 are stated as affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2) describes a network-reachable, low-complexity attack requiring high privileges and no user interaction, resulting in full compromise but no scope change. The high privilege requirement (PR:H) is the dominant limiting factor: an attacker must already hold elevated access to the JDeveloper environment, which sharply reduces real-world exploitability and pushes this toward an insider or post-compromise escalation scenario rather than an internet-facing mass-exploitation risk. No EPSS score, KEV listing, POC, or SSVC decision data was provided; absence of these signals combined with the PR:H gate suggests low immediate urgency. Note a mild tension: Oracle's own 'Information Disclosure' tag understates the C:H/I:H/A:H 'takeover' impact claimed in the description - treat the full-compromise characterization as authoritative and the tag as incomplete.

An attacker who has already obtained a high-privilege account on an Oracle JDeveloper instance sends crafted HTTP requests to the ADF Shared Components interface over the network, requiring no user interaction. Successful exploitation yields full takeover of JDeveloper, compromising confidentiality, integrity, and availability. No public proof-of-concept exploit code has been identified at time of analysis.