EUVD-2026-46767
GHSA-3x77-gx75-cpgx
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Network HTTP access required with low-privilege authentication and high exploit complexity; only partial confidentiality loss, with no integrity or availability impact, yielding no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle JDeveloper accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).
AnalysisAI
Partial data disclosure in Oracle JDeveloper's ADF Faces component (versions 12.2.1.4.0 and 14.1.2.0.0) allows low-privileged network-authenticated attackers to read a subset of JDeveloper-accessible data via crafted HTTP requests. Despite the 'Authentication Bypass' tag, the CVSS PR:L metric confirms full authentication is required - the bypass is best understood as an authorization or access-control bypass within ADF Faces rather than full session bypass. No public exploit has been identified and no CISA KEV listing exists; the low CVSS score of 3.1 reflects high exploit complexity and limited impact scope.
Technical ContextAI
Oracle JDeveloper is an Integrated Development Environment (IDE) and application development platform within the Oracle Fusion Middleware product family. The ADF Faces component is the JavaServer Faces (JSF)-based UI rendering framework of Oracle's Application Development Framework (ADF), responsible for processing and serving HTTP-based web UI requests in Oracle applications. The vulnerability resides specifically in this HTTP-facing component. No CWE identifier was assigned in the available data, but the 'Authentication Bypass' tag and the limited confidentiality impact suggest an improper authorization or access-control enforcement deficiency - likely a role/privilege boundary that can be crossed under specific conditions (reflected in the AC:H metric). The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) further indicates the attack surface is network-reachable over HTTP and does not require user interaction, but does require specific exploitation conditions to be met.
RemediationAI
Apply the patches provided in Oracle's July 2026 Critical Patch Update (CPU), documented at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle distributes patches through its CPU process and does not typically publish standalone patched version numbers outside the CPU documentation - administrators should consult the CPU advisory's patch availability matrix for the specific patch sets applicable to JDeveloper 12.2.1.4.0 and 14.1.2.0.0. No exact patched version number was independently confirmed from the available data. As a compensating control where immediate patching is not feasible, restrict HTTP access to Oracle JDeveloper ADF Faces endpoints to trusted internal network segments or VPN-authenticated connections only, reducing the network-accessible attack surface (AV:N); note this trade-off may impede legitimate remote developer access. Additionally, audit and minimize the population of low-privileged accounts with access to JDeveloper instances to reduce the pool of potential threat actors.
More in Jdeveloper
View allIn Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE
Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, 11.1.2.
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) becaus
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Rated high severity (CVSS 8.8), th
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write acce
Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: Security Framework). Rated h
Unauthorized information disclosure in Oracle JDeveloper (Fusion Middleware Security Framework) versions 12.2.1.4.0 and
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today