Oracle JDeveloper CVE-2026-73961

Requires a network-reachable Oracle JDeveloper instance (versions 12.2.1.4.0 or 14.1.2.0.0) exposing the ADF Faces component over HTTP. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication, user interaction, or special configuration is stated as necessary. The primary limiting factor is exposure: JDeveloper is Oracle's Java development IDE/tooling rather than a server product normally published to untrusted networks, so realistic reachability depends on the ADF Faces web tier being deployed and network-accessible to the attacker. No non-default setting is documented as a prerequisite, but the complete absence of technical detail in the Oracle CPU means the exact required request/feature cannot be named from available data.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes an ideal worst case: remote, unauthenticated, low-complexity, no user interaction, with full confidentiality/integrity/availability impact ('takeover'). Oracle explicitly calls it 'easily exploitable,' which aligns with AC:L/PR:N. However, the exploitation signals that would confirm real-world urgency are absent: no EPSS score is provided, the vulnerability is NOT in CISA KEV, no public POC exists, and no SSVC decision was supplied. There is therefore no public exploit identified at time of analysis, and no evidence of active exploitation - the 9.8 reflects potential severity, not demonstrated exploitation. A material caveat: Oracle CPU entries carry ZERO technical detail (no endpoint, parameter, request, or root-cause description), so the CWE-287 (Authentication Bypass) classification and the 9.8 are vendor-asserted and not independently verifiable. Net: treat as high-priority to patch because the affected component (ADF Faces web framework) is genuinely network-reachable and the impact claim is full takeover, but recognize the risk is a vendor-scored ceiling rather than a confirmed, weaponized threat.

An attacker with only network reach to a JDeveloper instance running ADF Faces (e.g., an exposed development/preview server) sends a crafted HTTP request that abuses the authentication weakness (CWE-287) to gain unauthenticated access. Because no authentication or user interaction is required, a single request could yield full compromise of the JDeveloper instance. No public POC or active exploitation has been reported at time of analysis.