EUVD-2026-46764
GHSA-r39f-pm9v-43mg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Local vector and PR:L confirmed by requirement for local infrastructure logon with low-privileged account; S:C reflects vendor-documented impact to additional products; no integrity or availability impact observed.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle JDeveloper executes to compromise Oracle JDeveloper. While the vulnerability is in Oracle JDeveloper, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
AnalysisAI
Local authentication bypass in Oracle JDeveloper's ADF Faces component exposes critical data to low-privileged local users on versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS scope change (S:C) indicates successful exploitation can extend beyond JDeveloper itself to impact additional Oracle Fusion Middleware products sharing the same infrastructure. No public exploit has been identified at time of analysis, and neither EPSS data nor a CISA KEV listing is available - however, the low attack complexity and no user interaction requirement make exploitation straightforward once local access is established.
Technical ContextAI
Oracle JDeveloper is Oracle's integrated development environment and application delivery framework within the Oracle Fusion Middleware stack, primarily used for building enterprise Java EE and Oracle ADF applications. The affected component, ADF Faces, is Oracle's JavaServer Faces (JSF)-based UI component framework embedded within JDeveloper and wider Fusion Middleware deployments. The vulnerability is tagged as an Authentication Bypass, suggesting a flaw in access control or session/identity validation logic within the ADF Faces layer - consistent with CWE-287 (Improper Authentication) or CWE-863 (Incorrect Authorization), though no CWE is formally assigned. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) confirms a local attack surface crossing a security boundary, with full confidentiality compromise as the outcome. Affected versions are Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0.
RemediationAI
Apply Oracle's Critical Patch Update (CPU) for July 2026 immediately, available at https://www.oracle.com/security-alerts/cpujul2026.html. Exact patched version identifiers are not independently confirmed from available data - consult the Oracle CPU advisory directly for specific patch build numbers for both the 12.2.1.4.0 and 14.1.2.0.0 release lines. As compensating controls prior to patching, restrict local logon access to JDeveloper hosts to only explicitly authorized administrators, removing or suspending low-privileged accounts that do not require infrastructure-level access; note this may impact developer workflows on shared servers. Audit and minimize connectivity between the JDeveloper host and adjacent Fusion Middleware systems to reduce scope-change blast radius if the vulnerability is exploited. Enabling host-based access controls (OS-level user isolation, filesystem permissions on JDeveloper data directories) can limit data reachability but will not remediate the underlying authentication bypass.
More in Jdeveloper
View allIn Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE
Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, 11.1.2.
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) becaus
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Rated high severity (CVSS 8.8), th
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write acce
Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: Security Framework). Rated h
Unauthorized information disclosure in Oracle JDeveloper (Fusion Middleware Security Framework) versions 12.2.1.4.0 and
Same weakness CWE-200 – Information Exposure
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today