EUVD-2026-46759
GHSA-vv8f-r6p9-4gvx
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network HTTP reachable and low-complexity, but requires pre-existing high privileges (PR:H); full compromise gives C:H/I:H/A:H with no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Shared Components). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in takeover of Oracle JDeveloper. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full compromise of Oracle JDeveloper (Oracle Fusion Middleware) is possible via the ADF Shared Components subcomponent, allowing an authenticated high-privileged attacker with HTTP network access to take over the product with high confidentiality, integrity, and availability impact. It affects supported versions 12.2.1.4.0 and 14.1.2.0.0, is disclosed in Oracle's July 2026 Critical Patch Update, and carries a CVSS 3.1 base score of 7.2. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
Oracle JDeveloper is a free integrated development environment from Oracle used to build Java, Java EE, and Oracle Application Development Framework (ADF) applications, and it ships as part of the broader Oracle Fusion Middleware stack. The affected component is ADF Shared Components, a set of reusable framework libraries underpinning ADF-based web applications and tooling. Oracle's advisory tags this as Information Disclosure, though the CVSS impact set (C:H/I:H/A:H) and the 'takeover' language indicate the flaw extends beyond confidentiality to full control. No CWE was assigned in the source data, so the precise root-cause weakness class (e.g., improper access control or deserialization) cannot be confirmed from the available inputs.
RemediationAI
Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor-released patch vehicle for this issue; the source data does not enumerate a specific fixed build number, so identify the exact patch for your 12.2.1.4.0 or 14.1.2.0.0 installation from that advisory. Until patched, reduce exposure by restricting network/HTTP access to JDeveloper and ADF-based endpoints to trusted administrative networks only, and tightly review who holds the high-privilege accounts that the exploit requires - since PR:H is mandatory, revoking or auditing elevated accounts directly shrinks the attack surface, at the cost of tighter operational access controls. Avoid exposing development/IDE instances to untrusted networks.
More in Jdeveloper
View allIn Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE
Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, 11.1.2.
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) becaus
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Rated high severity (CVSS 8.8), th
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write acce
Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: Security Framework). Rated h
Unauthorized information disclosure in Oracle JDeveloper (Fusion Middleware Security Framework) versions 12.2.1.4.0 and
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today