Oracle JDeveloper CVE-2026-91318

Exploitation requires luring a JDeveloper user (a person other than the attacker) into interacting with attacker-controlled content delivered over HTTP (UI:R); the attacker needs no credentials (PR:N) and no prior access. The primary limiting factor is this mandatory victim interaction - without a user acting on the malicious content there is no compromise. Only Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0 are stated as affected, and impact is limited to disclosure of confidentiality-sensitive data (no integrity or availability effect).

This is a moderate-severity information-disclosure flaw (CVSS 3.1 6.5) in Oracle JDeveloper's Security Framework. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates a network-reachable, low-complexity attack by an unauthenticated attacker, but exploitation is gated by required user interaction (UI:R) from a victim other than the attacker, which materially lowers real-world risk versus a fully unauthenticated server-side bug. Impact is confined to confidentiality (C:H, with I:N/A:N), so there is no integrity or availability loss. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 'Authentication Bypass' tag conflicts with the described behavior and CVSS metrics, which describe unauthorized data access requiring victim interaction rather than a bypass of authentication - treat that tag with skepticism. Net assessment: a legitimate confidentiality issue worth patching in the normal Oracle CPU cycle, but not an emergency given the user-interaction requirement, the confidentiality-only impact, and the developer-tool deployment profile.

An attacker crafts a malicious HTTP resource or link and lures a JDeveloper user into interacting with it. When the user opens or processes the attacker-controlled content, the Security Framework flaw is triggered, exposing critical data accessible to Oracle JDeveloper to the attacker. No public exploit code is identified at time of analysis, and success depends entirely on the victim performing the required interaction.