Oracle JDeveloper CVE-2026-60349

Exploitation requires: (1) a low-privileged authenticated account with network access to the Oracle JDeveloper instance via HTTP - unauthenticated exploitation is not supported by the CVSS vector (PR:L); (2) the target must be running JDeveloper version 12.2.1.4.0 or 14.1.2.0.0 specifically, as these are the only confirmed affected versions; (3) the attack complexity is rated High (AC:H), meaning the attacker must engineer specific conditions - such as a race condition, a precise request structure, or a particular server-side state - to successfully exploit the flaw; the exact condition is not disclosed in the available data. Limiting factors are: pre-existing low-privilege authentication is required; high complexity reduces the likelihood of opportunistic or automated exploitation; no user interaction is needed, which removes a defender-controlled friction point. The 'Authentication Bypass' tag may imply that the low-privilege credential barrier is itself part of what is bypassed, but this is not confirmed by the CVSS vector and should be verified with Oracle.

The CVSS 3.1 base score of 5.9 (Medium) reflects a realistic but constrained threat: the high attack complexity (AC:H) materially limits exploitability compared to straightforward network-facing vulnerabilities, and PR:L means the attacker must already hold some authenticated foothold. The confidentiality impact is rated High - indicating complete or critical data exposure - but integrity is unaffected (I:N) and availability impact is only partial (A:L). No EPSS score is present in the available data, no CISA KEV listing exists, and no public proof-of-concept has been identified, all of which support a conclusion that real-world exploitation risk is currently low-to-moderate. The 'Authentication Bypass' tag introduces ambiguity: if this tag reflects the actual exploit primitive, it could imply that the low-privilege requirement is itself bypassable, which would elevate practical risk beyond what the PR:L metric suggests - however, this cannot be confirmed from available data and the CVSS vector is the authoritative signal. Security teams operating Oracle Fusion Middleware environments with JDeveloper deployed should prioritize patching within the next regular maintenance window rather than treating this as an emergency.

An attacker with low-privilege credentials to an Oracle JDeveloper deployment sends a crafted HTTP request targeting the Java Business Objects component under specific environmental or request conditions that satisfy the high-complexity threshold. Upon triggering the flaw, the attacker gains unauthorized read access to sensitive or all JDeveloper-accessible data - potentially including source code, configuration secrets, or business logic artifacts - and may induce a partial service disruption. No public proof-of-concept exists at time of analysis, meaning exploitation requires independent vulnerability research to replicate the required conditions.