Oracle JDeveloper CVE-2026-60348

Exploitation requires unauthenticated network access via HTTP to an Oracle JDeveloper instance running version 12.2.1.4.0 or 14.1.2.0.0 with the ADF Faces component active and reachable (CVSS PR:N confirms no prior authentication is needed). The High Attack Complexity (AC:H) indicates the attacker must satisfy conditions beyond simple network connectivity - the exact prerequisite is not described in available sources, but AC:H typically reflects requirements such as a specific server configuration state, timing window, race condition, or multi-step request sequence. What limits exploitation: the AC:H constraint eliminates trivial or automated mass-scanning exploitation; the attack is scoped strictly to confidentiality, with no write or denial-of-service path; JDeveloper is an IDE not typically exposed to untrusted networks, substantially reducing the reachable attack surface in standard enterprise deployments; and no public exploit or KEV-confirmed active exploitation exists at time of analysis.

The CVSS 5.9 Medium score is driven by two competing signals: AV:N and PR:N indicate the vulnerability is remotely exploitable without credentials - a significant reach - while AC:H substantially constrains practical exploitability, requiring the attacker to meet conditions beyond trivial HTTP access, such as specific server state, request timing, or session sequencing. The confidentiality-only impact (C:H, I:N, A:N) bounds the worst-case outcome to data exposure rather than system takeover. No EPSS score was included in the intelligence data, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing and no public exploit code have been identified at time of analysis. The 'Authentication Bypass' tag from Oracle's own security team adds credibility to the severity characterization, but the AC:H vector means this is not a fire-and-forget exploit. Real-world risk is highest for organizations exposing JDeveloper HTTP endpoints to untrusted networks - an atypical deployment posture for a development IDE, which meaningfully reduces the exposed population. This is not a deprioritized issue but also not an immediate emergency absent a working exploit.

An unauthenticated attacker with HTTP access to an exposed Oracle JDeveloper instance sends a crafted HTTP request sequence to the ADF Faces endpoint that satisfies the high-complexity prerequisites - potentially specific header values, a particular server-side state, or a race condition - causing the authentication mechanism to be bypassed. Upon successful exploitation, the attacker gains read access to all data accessible within the JDeveloper context, which may include application source code, embedded credentials, database connection strings, or other sensitive development artifacts. No public exploit code has been identified at time of analysis, meaning this scenario currently requires sophisticated, targeted effort.