What is the CVSS score of CVE-2026-61061?

CVE-2026-61061 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Oracle JDeveloper are affected by CVE-2026-61061?

Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0 contain a local privilege escalation vulnerability in the Security Framework that allows low-privileged users to fully compromise the development…

How to fix or mitigate CVE-2026-61061?

Within 24 hours: identify all systems running Oracle JDeveloper 12.2.1.4.0 or 14.1.2.0.0 and restrict local interactive logon to these hosts to administrative users only, implementing multi-factor authentication for any local access. Within 7 days: enable enhanced logging and monitoring for privilege escalation attempts on affected systems, conduct access reviews to remove unnecessary local accounts, and isolate affected JDeveloper instances to a segregated development network segment if not already segregated. Within 30 days: apply the Oracle July 2026 Critical Patch Update to all affected systems as soon as formally released and validated in your environment.

Oracle JDeveloper CVE-2026-61061

EUVD-2026-47273 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-r8wp-652f-677f

Oracle Privilege Escalation Jdeveloper

7.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Requires an existing low-privileged local logon (AV:L, PR:L) with hard-to-control trigger conditions (AC:H), yielding full component takeover, so C/I/A all High.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:02 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.0

DescriptionCVE.org

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Security Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle JDeveloper executes to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in takeover of Oracle JDeveloper. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Local privilege-based compromise in Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 (Security Framework component of Oracle Fusion Middleware) allows a low-privileged attacker with an interactive logon to the host to fully take over the JDeveloper installation, impacting confidentiality, integrity, and availability. Fixed in the Oracle July 2026 Critical Patch Update, the flaw is rated CVSS 7.0 but is explicitly high-complexity (AC:H) and requires local access, so no public exploit identified at time of analysis and no active exploitation is confirmed. It is tagged as an Information Disclosure issue by Oracle, though the vector shows full C/I/A impact consistent with a complete component takeover.

Technical ContextAI

Oracle JDeveloper is a free integrated development environment (IDE) from Oracle used to build Java, Java EE, and Oracle Fusion Middleware applications; it ships as part of the broader Fusion Middleware stack. The affected component is the Security Framework, the subsystem responsible for authentication, credential handling, and access control within the IDE and its runtime. No CWE was assigned in the source data, so the precise root-cause class (e.g., improper access control, credential exposure, or deserialization) cannot be stated with certainty; the 'Information Disclosure' tag combined with full integrity and availability impact suggests a security-control weakness that leaks sensitive data and can be escalated to full component compromise rather than a simple read-only leak.

RemediationAI

Apply the fix delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory) by upgrading JDeveloper 12.2.1.4.0 and 14.1.2.0.0 to the corresponding CPU-patched builds documented at https://www.oracle.com/security-alerts/cpujul2026.html; the advisory lists the exact patch numbers per version. Until patching, reduce risk by tightening who can interactively log on to hosts running JDeveloper, since exploitation requires a local low-privileged account - restrict and audit local and remote (RDP/SSH) logon rights on developer and build machines, and remove shared or unnecessary accounts. Because JDeveloper is a developer workstation/build-server tool rather than an internet-facing service, isolating those hosts on segmented networks and enforcing least-privilege on the OS meaningfully limits the attack surface; the trade-off is added friction for developers who share environments. No effective feature-level workaround is described by Oracle, so patching on the CPU cycle remains the primary control.