What is the CVSS score of CVE-2026-60629?

CVE-2026-60629 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle JDeveloper are affected by CVE-2026-60629?

Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0 contain a high-severity vulnerability enabling unauthenticated remote access to read and modify sensitive data; no public exploit identified at…

How to fix or mitigate CVE-2026-60629?

Within 24 hours, inventory all Oracle JDeveloper installations and identify systems running versions 12.2.1.4.0 or 14.1.2.0.0, documenting network connectivity and data sensitivity of each instance. Over the next 7 days, implement network segmentation restricting unauthenticated HTTP access via firewall rules (VPN-only or IP allowlisting), disable public-facing HTTP access, and implement reverse proxy authentication for any required external connectivity. Within 30 days, establish a monitoring cadence for Oracle security advisories to apply patches immediately upon release, deploy Web Application Firewall (WAF) rules targeting CVE-2026-60629 exploitation attempts, enable comprehensive audit logging of JDeveloper data access and modifications, and evaluate feasibility of upgrading to unaffected JDeveloper versions.

Oracle JDeveloper CVE-2026-60629

EUVD-2026-46987 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-j57r-gj3j-4v72

Authentication Bypass Oracle Jdeveloper

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

7.5 HIGH

Network-reachable and unauthenticated (AV:N/PR:N) but vendor-confirmed difficult to exploit (AC:H); high confidentiality and limited integrity impact with a scope change into adjacent products, no availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:19 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Data Visualization Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper. While the vulnerability is in Oracle JDeveloper, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data as well as unauthorized update, insert or delete access to some of Oracle JDeveloper accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N).

AnalysisAI

Unauthorized critical-data access in Oracle JDeveloper (Fusion Middleware, Data Visualization Tools component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a remote unauthenticated attacker read all JDeveloper-accessible data and modify some of it over HTTP, with a scope change that can significantly impact adjacent Oracle products. Oracle rates it CVSS 3.1 7.5 but flags it as difficult to exploit (AC:H). No public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently theoretical but non-trivial given the unauthenticated network vector.

Technical ContextAI

Oracle JDeveloper is Oracle's Java/ADF integrated development environment and a component of the Oracle Fusion Middleware stack; the flaw sits in its Data Visualization Tools component, which renders charts and data views. The advisory does not disclose the flaw class (CWE is N/A and CWE mapping is absent), but the vendor-supplied tag 'Authentication Bypass' together with the scope-change (S:C) and confidentiality-heavy impact profile is consistent with a server-side request or data-exposure style weakness reachable over HTTP without credentials. Because the vulnerability crosses a trust boundary into 'additional products,' the exposed surface is likely a web-facing service or embedded server within the JDeveloper/ADF runtime rather than the desktop editor alone. No CPE strings were provided in the intelligence; affected products are identified only by Oracle/EUVD version strings.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to the affected 12.2.1.4.0 and 14.1.2.0.0 installations; the intelligence provides the CPU advisory as the patch source but does not enumerate an exact post-patch build number, so consult the CPU patch matrix for the precise interim/one-off patch for your JDeveloper release. This is Patch available per vendor advisory (Oracle CPU July 2026); a specific fixed version string was not included in the provided data and should not be invented. Until patching, reduce exposure by restricting network access to any HTTP endpoints exposed by JDeveloper/ADF Data Visualization services to trusted developer subnets or VPN only, and avoid exposing JDeveloper-hosted services to the internet - the trade-off is reduced remote developer accessibility. Because attacks may cross into additional Oracle products (scope change), also review and segment connected Fusion Middleware components; the side effect is added network-management overhead but it contains the blast radius if the primary flaw is triggered.