Oracle JDeveloper CVE-2026-83423

Requires (1) network reachability to an Oracle JDeveloper HTTP service - i.e. the instance's listener bound to a non-loopback interface or otherwise proxied, since AV:N and the 'network access via HTTP' wording in the description are explicit; (2) a valid low-privilege account/credential on the product, as PR:L means the attacker must already possess some authenticated access and cannot exploit this pre-auth; and (3) JDeveloper versions 12.2.1.4.0 or 14.1.2.0.0 with the Security Framework component present. No user interaction is required (UI:N) and the attack complexity is low (AC:L), so no race condition or special payload constraints limit it. Exploitation is strictly limited by credential possession, by default configurations that bind JDeveloper's services to localhost, and by the fact that a typical developer workstation is not internet-exposed - a single-user IDE install with no remote listener is effectively unreachable. The absence of a disclosed CWE or POC means the precise vulnerable feature within the Security Framework is not identified in the available data.

The CVSS vector is unambiguous - AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - describing a remotely reachable, low-complexity, unauthenticated-at-the-network-layer but low-privilege-authenticated attack that yields complete loss of confidentiality, integrity, and availability of the JDeveloper instance. The 'low privileged attacker' qualifier is the single most important risk limiter: an attacker must first hold some account on the product or its host network path, which raises the bar versus a pure pre-auth flaw and makes internet-facing exposure far more dangerous than an isolated developer workstation. No EPSS probability, no POC indicator, and no CISA KEV entry were provided, so there is no evidence of active exploitation; the SSVC-style reading is 'exploitation: none observed', 'automatable: no (credential prerequisite)', 'technical impact: total' - a high-severity, patch-now issue for exposed instances but not an emergency for air-gapped or developer-only installs. The tag 'Information Disclosure' conflicts with the description's explicit 'takeover' language and full C/I/A impact; treat the tag as inaccurate. An important gap: the CWE is missing and no EPSS/KEV/POC data was supplied, so exploitability beyond the CVSS vector is unverified. JDeveloper is a desktop/development IDE, so the practical blast radius depends almost entirely on whether its HTTP listeners are bound to non-loopback interfaces.

An attacker with a valid low-privilege account on the network - for example a compromised developer credential or a low-trust internal host - sends crafted HTTP requests to the exposed JDeveloper service and abuses the Security Framework flaw to escalate to full control of the instance. Because no user interaction (UI:N) and no elevated privilege (PR:L) are needed, the attack can be scripted against any reachable JDeveloper HTTP endpoint, allowing the attacker to read workspace data and credentials, alter projects or deployment artifacts, and disrupt the IDE. No public exploit code exists at time of analysis, so the attack would currently require bespoke research rather than a copy-paste tool.