EUVD-2026-46762
GHSA-2jf3-3mg6-vvf7
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Network vector and no privileges align with the HTTP authentication bypass; AC:H reflects non-trivial exploitation prerequisites; C:H captures full read access; I:N and A:N reflect the strictly confidentiality-bounded impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
AnalysisAI
Unauthenticated network exploitation of the ADF Faces component in Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 enables complete confidentiality compromise of all data accessible within the IDE environment via HTTP. Tagged explicitly as an Authentication Bypass by Oracle's security team (secalert_us@oracle.com), the flaw allows a remote attacker with no credentials to circumvent access controls, though the CVSS AC:H rating constrains opportunistic exploitation by requiring attacker-controlled preconditions to be met. No public exploit or CISA KEV listing exists at time of analysis, and the impact is limited strictly to data exfiltration - no integrity or availability risk is present.
Technical ContextAI
Oracle JDeveloper is an enterprise-grade integrated development environment (IDE) distributed as part of Oracle Fusion Middleware, primarily used for developing applications built on Oracle ADF (Application Development Framework). The specifically affected component, ADF Faces, is Oracle's JSF-based (JavaServer Faces) UI rendering layer that processes HTTP requests in ADF web applications. Affected versions confirmed by EUVD-2026-46762 and the Oracle CPU July 2026 advisory are 12.2.1.4.0 (a long-term-support branch) and 14.1.2.0.0 (the current major release). No CWE identifier has been assigned by NVD or Oracle, which limits precise root-cause classification; however, the reporter-supplied tag 'Authentication Bypass' places this vulnerability in the class of CWE-287 (Improper Authentication) or CWE-306 (Missing Authentication for Critical Function). The HTTP attack vector suggests the bypass manifests in a network-facing ADF Faces request-handling code path, not in a local configuration layer.
RemediationAI
Patch available per vendor advisory - Oracle released a fix for this vulnerability as part of the Critical Patch Update for July 2026; consult the advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch identifiers and installation instructions applicable to JDeveloper 12.2.1.4.0 and 14.1.2.0.0. An exact patched release version number was not independently confirmed in the available intelligence data. As an immediate compensating control prior to patching, restrict network access to JDeveloper HTTP endpoints to trusted internal hosts using host-based or network-level firewall rules, since the attack vector is AV:N and JDeveloper is a development tool that should not be internet-facing; this control is highly effective and low in operational trade-off for most environments. If ADF Faces functionality is not actively required in the affected deployment, disabling the ADF Faces component may eliminate the attack surface entirely, though this will impact any ADF web application functionality served through that instance.
More in Jdeveloper
View allIn Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE
Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, 11.1.2.
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) becaus
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Rated high severity (CVSS 8.8), th
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write acce
Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: Security Framework). Rated h
Unauthorized information disclosure in Oracle JDeveloper (Fusion Middleware Security Framework) versions 12.2.1.4.0 and
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today