EUVD-2026-106376
GHSA-8p7m-72mg-f2pr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local logon on JDeveloper host
-
ExploitAccess ADF Faces component
-
ExecutionExploit confidentiality flaw
-
ImpactRead unauthorized critical data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged local login (PR:L) on the infrastructure where Oracle JDeveloper 12.2.1.4.0 or 14.1.2.0.0 executes - the attacker must already have shell/account access to that host, as the vector is local (AV:L), not network-reachable. Exploitation targets the ADF Faces component and yields read access to critical JDeveloper-accessible data only (C:H; no integrity or availability impact). Limiting factors: no remote exploitation, no exploitation from an unauthenticated position, and the attacker must share or access the host where JDeveloper is installed, which is typically a developer workstation or build server rather than an internet-facing service. |
| Impact | This is a moderate-severity, low-priority issue despite the 'Authentication Bypass' tag. The confirmed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a LOCAL vulnerability requiring an already-authenticated low-privileged account on the host where Oracle JDeveloper runs - not a remote or network-exploitable flaw and not an authentication bypass. Impact is limited to confidentiality (C:H), with no integrity or availability effect, meaning it leaks data but cannot modify or disrupt. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or probable exploitation. Signals are internally consistent except for the 'Authentication Bypass' tag, which conflicts with the vector: AV:L + PR:L means the attacker must already have a valid local login, so this is an information-disclosure/privilege-scoped data access issue, not an auth bypass - verify the tag with Oracle. Overall this is a routine Oracle CPU patch item, not an emergency. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged local account (e.g., a developer or shared-host user) on the server where Oracle JDeveloper 12.2.1.4.0 or 14.1.2.0.0 runs leverages a flaw in the ADF Faces component to read data belonging to other JDeveloper users or the application. The low attack complexity (AC:L) means no special timing or conditions are needed once local access exists. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Local, low-privileged users who can log on to a host where Oracle JDeveloper 12.2.1.4.0 or 14.1.2.0.0 is installed can read critical data exposed through the ADF Faces component, giving them access to anything the JDeveloper process can reach (CVSS 5.5, confidentiality-only). The attacker must already hold a valid account and shell access on the developer workstation or build server running the IDE - this is not network-reachable and cannot be triggered from an unauthenticated position. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle addresses the flaw in its October 2026 Critical Patch Update; despite the 'Authentication Bypass' classification tag, the assessed vector makes this a moderate, low-priority issue for most environments.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the vendor-released fix path for JDeveloper 12.2.1.4.0 and 14.1.2.0.0; the input data does not specify an exact patched build number, so confirm the target version in the CPU advisory before upgrading and treat any version below the CPU-listed build as exposed. Because the vector is local and requires an existing low-privileged logon, the effective compensating controls are host-side: restrict interactive logon on machines running JDeveloper to named developers and build-service accounts (removing shared or generic logins, at the cost of some build automation convenience), and isolate build servers that host JDeveloper from general-purpose user populations so that an unrelated low-privileged account cannot reach the installation. Where JDeveloper is used on shared infrastructure, run it under a dedicated per-user account with a scoped workspace so that data readable by the IDE process is not co-mingled with credentials for production systems; the trade-off is additional account and profile management overhead. Auditing local logons and file access on developer workstations provides detection coverage for post-authentication data collection, and rotating any credentials or connection strings stored in JDeveloper configuration and workspace files is prudent if host compromise is suspected. No vendor workaround short of the CPU is documented in the available references.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle JDeveloper is Oracle's integrated development environment for Java/Java EE and the Oracle Fusion Middleware stack, and ADF Faces (Apache MyFaces Trinidad-derived JSF component library) is the rich web UI framework bundled with it for building Fusion Middleware applications. The defect sits in the ADF Faces component of the shipped JDeveloper installation, and Oracle scores it as AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - a local, low-complexity, no-user-interaction path requiring only a low-privileged OS account on the host. Because the vector is local rather than adjacent or network, exploitation depends on the attacker already possessing logon rights to the developer workstation or build agent, which limits the population of realistic attackers to insiders, co-tenants on shared build infrastructure, or an adversary who has already achieved host foothold. No CWE identifier was supplied with the record, so the root-cause class cannot be pinned beyond Oracle's generic characterization; the practical consequence is a confidentiality-only exposure (C:H) with no integrity or availability effect, meaning data readable by the JDeveloper process - workspace files, cached credentials, configuration and connection metadata - is the plausible target. Notably, third-party tagging labels this an 'Authentication Bypass', but the authoritative assessed vector describes a post-authentication local information disclosure, so the tag should not be read as permitting pre-auth remote access.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Description confirms local logon by a low-privileged user (AV:L, PR:L), no user interaction, easy exploitation (AC:L), and confidentiality-only impact (C:H, I:N, A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle JDeveloper executes to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB