Oracle JDeveloper CVE-2026-91319

Exploitation targets the Java Business Objects component of Oracle JDeveloper reachable over HTTP, and per CVSS PR:N requires no authentication. However, CVSS AC:H and Oracle's 'difficult to exploit' classification indicate success is gated by specific preconditions beyond the attacker's control (e.g., particular request timing, data state, or configuration), which is the primary limiting factor. Impact is confined to integrity - unauthorized creation, deletion, or modification of critical or all JDeveloper-accessible data - with no confidentiality (C:N) or availability (A:N) impact. Realistic exposure is further limited because JDeveloper is a developer tool that is not typically internet-exposed in production. Affected versions are Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0.

This is a moderate-severity integrity flaw (CVSS 3.1 base 5.9) in Oracle JDeveloper's Java Business Objects component. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) describes a network-reachable, unauthenticated attack with HIGH attack complexity and impact limited solely to integrity (no confidentiality or availability loss). The high attack complexity (AC:H) is the dominant risk-limiting signal: Oracle explicitly describes it as 'difficult to exploit,' meaning success depends on conditions outside the attacker's control. EPSS is not provided in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. Signals are internally consistent - there is no network-vs-local conflict - but the combination of AC:H, integrity-only impact, and the product being a developer IDE rather than an exposed production service makes this a lower real-world priority than its 'network/unauthenticated' metrics alone might suggest. Note: the input 'Authentication Bypass' tag conflicts with the actual impact profile (data integrity compromise, not an auth bypass) and appears mislabeled.

A remote, unauthenticated attacker sends specially crafted HTTP requests to an exposed Oracle JDeveloper instance to exploit the Java Business Objects component, achieving unauthorized creation, deletion, or modification of critical data. Because the CVSS vector specifies high attack complexity (AC:H), the attacker must satisfy specific non-trivial preconditions for reliable success. No public proof-of-concept or exploit code is referenced in the available data.