What is the CVSS score of CVE-2026-60349?

CVE-2026-60349 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Oracle JDeveloper CVE-2026-60349

EUVD-2026-46763 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-2q2m-qrpr-hh89

Oracle Java Denial Of Service Authentication Bypass Information Disclosure Jdeveloper

5.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L

vuln.today AI

5.9 MEDIUM

Network vector via HTTP confirmed; AC:H per explicit 'difficult to exploit' language; PR:L per low-privileged attacker requirement; no integrity or scope impact per description.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:22 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Java Business Objects). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle JDeveloper. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L).

AnalysisAI

Oracle JDeveloper's Java Business Objects component exposes a network-accessible confidentiality and availability flaw in versions 12.2.1.4.0 and 14.1.2.0.0, allowing low-privileged remote attackers to gain unauthorized access to critical or all JDeveloper-accessible data alongside a partial denial of service. The attack complexity is rated high, requiring specific conditions to be met, but no user interaction is needed beyond initial low-privilege authentication. No public exploit code or active exploitation has been identified at time of analysis; this was disclosed as part of Oracle's Critical Patch Update for July 2026.

Technical ContextAI

Oracle JDeveloper is an integrated development environment (IDE) and application framework distributed as part of Oracle Fusion Middleware. The affected component, Java Business Objects, handles data access and object modeling within the JDeveloper runtime. Although no CWE is formally assigned, the presence of the 'Authentication Bypass' tag alongside the network-accessible attack vector suggests a flaw in access control or authorization logic within the Java Business Objects layer - potentially allowing a low-privileged caller to bypass object-level or component-level authorization to reach sensitive data structures. The CVSS vector (AV:N/AC:H/PR:L) is consistent with an exploitation path requiring pre-existing low-privilege HTTP access combined with a specific request pattern or environmental condition to trigger the bypass. Affected CPE-inferred products are Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0.

RemediationAI

Apply the patch delivered via Oracle's Critical Patch Update for July 2026, available through Oracle's standard patch delivery mechanisms at https://www.oracle.com/security-alerts/cpujul2026.html. The advisory does not specify an exact fixed version number in the available data - consult Oracle My Oracle Support for the precise patch artifact applicable to JDeveloper 12.2.1.4.0 and 14.1.2.0.0. As a compensating control where immediate patching is not feasible, restrict HTTP access to JDeveloper's Java Business Objects endpoints to trusted internal network segments or VPN-only access, reducing the network-accessible attack surface. Additionally, enforce the principle of least privilege on JDeveloper accounts to ensure that the low-privilege account class required for exploitation is limited in scope. Neither compensating control eliminates the underlying flaw and patching remains the definitive remediation.