EUVD-2026-46766
GHSA-544w-8775-jhw9
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Network vector confirmed by HTTP attack path; AC:H reflects Oracle's 'difficult to exploit' classification; PR:N per unauthenticated access; C:L only, no integrity or availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle JDeveloper accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
AnalysisAI
Unauthorized read access to a subset of Oracle JDeveloper data is possible via an unauthenticated HTTP-based attack against the ADF Faces component in Oracle Fusion Middleware. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, and while exploitation requires high attack complexity, no authentication is needed. No public exploit code has been identified at time of analysis, no active exploitation is confirmed, and the CVSS 3.1 score of 3.7 (Low) reflects the limited confidentiality impact and elevated exploitation difficulty.
Technical ContextAI
Oracle JDeveloper is a Java IDE bundled within Oracle Fusion Middleware, primarily used in Oracle-centric enterprise development environments. The affected component, ADF Faces, is a JavaServer Faces (JSF)-based UI framework that handles web rendering and request processing for ADF (Application Development Framework) applications. The vulnerability resides in how ADF Faces handles HTTP requests, and the tag 'Authentication Bypass' suggests the flaw permits circumvention of an access control or identity-check mechanism to expose a limited subset of application data. No CWE identifier is available from the provided intelligence, so the precise root cause class (e.g., improper access control, insecure direct object reference, or session handling flaw) cannot be confirmed. Affected CPE-equivalent versions per Oracle advisory are Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 under the Oracle Fusion Middleware product line.
RemediationAI
Apply the patches provided in Oracle's July 2026 Critical Patch Update (CPU), available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publish exact patch version strings externally in the CPU advisory itself, so administrators should consult My Oracle Support for the specific patch IDs applicable to JDeveloper 12.2.1.4.0 and 14.1.2.0.0. Exact fix versions are not independently confirmed from the available intelligence data. As a compensating control while patching, restrict HTTP access to JDeveloper instances to trusted internal networks using firewall rules or network ACLs - this does not eliminate the vulnerability but significantly raises the bar for exploitation given the already-high attack complexity. Note that JDeveloper is a development-phase IDE and typically should not be exposed to untrusted network segments in production; validating network segmentation around JDeveloper deployments is a high-value control regardless of this CVE.
More in Jdeveloper
View allIn Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE
Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, 11.1.2.
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) becaus
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Rated high severity (CVSS 8.8), th
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write acce
Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: Security Framework). Rated h
Unauthorized information disclosure in Oracle JDeveloper (Fusion Middleware Security Framework) versions 12.2.1.4.0 and
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today