Oracle JDeveloper CVE-2026-60629

Exploitation targets the Data Visualization Tools component of Oracle JDeveloper 12.2.1.4.0 or 14.1.2.0.0 and requires that this component be reachable by the attacker over HTTP (network vector, no authentication and no user interaction per PR:N/UI:N). The dominant limiting factor is high attack complexity (AC:H): Oracle explicitly rates it 'difficult to exploit,' indicating the attacker must satisfy specific non-trivial preconditions (such as timing, configuration, or crafted-request state) rather than firing a single trivial payload. Practical exposure is further limited to deployments where JDeveloper's affected HTTP service is actually network-accessible; installations kept on isolated developer workstations or trusted subnets are far harder to reach. The scope change (S:C) means a successful attack can extend impact to additional Oracle products, so a limiting factor for the attacker is also an escalation opportunity where those adjacent products are co-deployed.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N) shows a network-reachable, unauthenticated issue whose main mitigating factor is high attack complexity - Oracle explicitly labels it 'difficult to exploit,' which materially lowers real-world likelihood despite the unauthenticated vector. No EPSS score was provided, no proof-of-concept is referenced, and the CVE is absent from CISA KEV, so all exploitation signals are currently low or unknown; the 7.5 score is driven by the C:H confidentiality impact plus the scope change, not by ease of attack. The vendor 'Authentication Bypass' tag is a stronger qualitative signal than the description text, which only states the attacker is unauthenticated - treat the bypass framing as vendor-asserted but not independently detailed. Overall this is a moderate, patch-on-cycle priority rather than an emergency: high complexity plus no observed exploitation offsets the unauthenticated network reach. Note a mild tension worth flagging: the scope change and 'significantly impact additional products' language imply broader blast radius than a base 7.5 might suggest - verify environmental exposure with Oracle's July 2026 CPU.

A remote attacker with no credentials sends specially crafted HTTP requests to a network-reachable JDeveloper Data Visualization Tools endpoint, working through the high-complexity conditions needed to trigger the flaw, and gains read access to all JDeveloper-accessible data plus limited write access. Because of the scope change, the attacker may then pivot to affect connected Oracle products beyond JDeveloper itself. No public proof-of-concept is known at time of analysis, so an attacker would need to independently develop the exploit.