EUVD-2026-46765
GHSA-jjv8-5qvv-35qc
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-accessible HTTP vector with no auth required (PR:N), but AC:H reflects meaningful exploitation difficulty; no availability impact and limited C/I scope per description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle JDeveloper accessible data as well as unauthorized read access to a subset of Oracle JDeveloper accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
AnalysisAI
Oracle JDeveloper's ADF Faces component on versions 12.2.1.4.0 and 14.1.2.0.0 is susceptible to an authentication bypass exploitable over HTTP by unauthenticated network attackers. Successful exploitation yields partial unauthorized read and write/insert/delete access to data accessible within the JDeveloper context - confidentiality and integrity are both impacted at a limited scope. No public exploit has been identified at time of analysis, and the CVSS AC:H rating indicates meaningful technical barriers to exploitation, reducing the practical threat level despite the unauthenticated attack vector.
Technical ContextAI
Oracle JDeveloper is Oracle's integrated development environment for Java and Oracle ADF (Application Development Framework) applications. The affected component, ADF Faces, is a JavaServer Faces (JSF)-based UI framework used to build Oracle ADF web applications. The vulnerability is tagged as an Authentication Bypass, suggesting that the ADF Faces layer fails to correctly enforce access controls under specific conditions, allowing network-reachable HTTP endpoints to be accessed without credentials. No CWE has been assigned by the reporter, leaving the precise root cause class unconfirmed; common authentication bypass patterns in JSF/ADF include improper session validation, insecure direct object references, or bypasses in filter chain logic. Affected CPE strings are implied by the version strings Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 per EUVD-2026-46765.
RemediationAI
The primary fix is to apply Oracle's July 2026 Critical Patch Update (CPU), available via Oracle Support and documented at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPUs bundle patches for all affected components; no standalone patch version has been independently confirmed beyond the CPU reference. As a compensating control, organizations should ensure JDeveloper and any ADF Faces-enabled development instances are not exposed to untrusted networks - restricting HTTP access to internal networks or VPN-only access would eliminate the network attack vector entirely. Additionally, enforcing authentication at the network perimeter (e.g., reverse proxy requiring authentication before JDeveloper HTTP endpoints are reachable) reduces exposure. Note that JDeveloper is a development tool and should not be Internet-facing under any circumstances; if it is, that represents a separate architectural risk beyond this CVE.
More in Jdeveloper
View allIn Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE
Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, 11.1.2.
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) becaus
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Rated high severity (CVSS 8.8), th
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write acce
Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: Security Framework). Rated h
Unauthorized information disclosure in Oracle JDeveloper (Fusion Middleware Security Framework) versions 12.2.1.4.0 and
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today