What is the CVSS score of CVE-2026-60622?

CVE-2026-60622 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle JDeveloper are affected by CVE-2026-60622?

Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0 contain an unauthenticated remote information disclosure vulnerability (CVSS 7.5) allowing attackers to read all JDeveloper-accessible data…

How to fix or mitigate CVE-2026-60622?

Within 24 hours: Identify all systems running JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0 and determine which are accessible over HTTP or network; immediately restrict access via firewall rules and network segmentation. Within 7 days: Implement compensating controls by disabling remote HTTP access to JDeveloper, requiring VPN or bastion host access at minimum, and moving development systems behind restricted network boundaries. Within 30 days: Monitor Oracle security advisories for an official patch to CVE-2026-60622; evaluate upgrading to non-vulnerable JDeveloper versions or alternative development tools if patches remain unavailable, and conduct audit of data potentially accessed during exposure window.

Oracle JDeveloper CVE-2026-60622

EUVD-2026-46980 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-9vxg-gf3x-5wh9

Authentication Bypass Oracle Jdeveloper

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network HTTP access with low complexity yields PR:N/AV:N/AC:L; impact is read-only data disclosure so C:H with I:N and A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:21 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Security Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized information disclosure in Oracle JDeveloper (Fusion Middleware Security Framework) versions 12.2.1.4.0 and 14.1.2.0.0 lets a network attacker read critical data without credentials. Remote unauthenticated attackers reaching the product over HTTP can obtain complete access to all JDeveloper-accessible data, with a CVSS 3.1 base score of 7.5 driven entirely by confidentiality impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor tag 'Authentication Bypass' suggests the flaw stems from a missing or broken authentication check.

Technical ContextAI

Oracle JDeveloper is a Java integrated development environment and part of the Oracle Fusion Middleware stack; the affected component is its Security Framework, the layer responsible for authentication and access control. The vendor-supplied tag 'Authentication Bypass' combined with a pure-confidentiality CVSS vector (C:H/I:N/A:N) points to a root-cause class where an access-control or authentication gate can be circumvented over HTTP, exposing protected data without a valid session (conceptually CWE-287 Improper Authentication / CWE-306 Missing Authentication for Critical Function, though NVD lists CWE as N/A). No CPE strings were provided in the input; affected products are identified only by the two Oracle version strings 12.2.1.4.0 and 14.1.2.0.0.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - this is the primary and vendor-authoritative remediation for both affected versions 12.2.1.4.0 and 14.1.2.0.0; the input does not state a discrete fixed build number beyond the CPU, so treat 'Patch available per vendor advisory' as the patch status and follow the CPU matrix for the exact patch bundle. Until the CPU can be applied, restrict network reachability to JDeveloper: ensure it is not exposed to untrusted networks or the internet, place it behind VPN or firewall rules limiting HTTP access to trusted developer subnets, and monitor HTTP access logs for anomalous unauthenticated requests. The trade-off of network restriction is reduced remote accessibility for legitimate distributed development, which is generally acceptable for a developer IDE that rarely needs public exposure.