EUVD-2026-106571
GHSA-q4jw-q273-7f28
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged account
-
DeliveryReach SOAP endpoint over network
-
ExploitCraft malicious ADF Databinding SOAP request
-
ExecutionExploit complex data-binding flaw
-
ImpactRead critical data / trigger partial DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to (1) already possess a low-privileged authenticated account on the target Oracle JDeveloper instance (PR:L) and (2) reach the SOAP interface exposed by the ADF Databinding component over the network. Oracle classifies the flaw as 'difficult to exploit' (AC:H), indicating success depends on conditions outside the attacker's direct control - likely specific data-binding configurations, timing, or environmental state - rather than default, one-shot exploitation. Limiting factors: no anonymous/unauthenticated path, no path to integrity modification (I:N), and only partial availability impact (A:L); the primary realistic risk is confidential data disclosure (C:H) by an insider or a compromised low-privilege account. |
| Impact | This is a moderate-severity, lower-priority issue despite the sensitive confidentiality impact. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L, base 5.9) shows a network-reachable flaw but with two meaningful brakes: high attack complexity (AC:H, described by Oracle as 'difficult to exploit') and a requirement for existing low-level privileges (PR:L), meaning the attacker must already be an authenticated user who can reach the SOAP interface. Impact is asymmetric - full confidentiality compromise (C:H, 'unauthorized access to critical data') but no integrity impact (I:N) and only a partial denial of service (A:L). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or imminent exploitation; the combination of AC:H plus PR:L further lowers real-world exploitability. Note a conflict between the input Tags and the CVSS data: the 'Authentication Bypass' tag contradicts PR:L, which explicitly requires authenticated access rather than bypassing it - treat that tag as suspect. Overall this belongs on a routine Oracle Critical Patch Update remediation cycle rather than an emergency response. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged account on an Oracle JDeveloper instance sends a specially crafted SOAP request that abuses the ADF Databinding component, reading critical data they should not be able to access and optionally degrading service availability. The high attack complexity means the attacker must satisfy non-trivial preconditions or win a race/configuration-dependent condition, and no public exploit code is known at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 expose an ADF Databinding flaw that lets a low-privileged authenticated user reach critical data over the network via SOAP, with a secondary ability to cause a partial denial of service. Oracle rates the issue 'difficult to exploit' (AC:H), so success hinges on configuration or environmental conditions rather than a straightforward single request; integrity is unaffected, and the realistic risk is confidential-data disclosure by an insider or a compromised low-privilege account. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, making this a moderate, lower-priority item for patch planning.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the vendor-released fix path for JDeveloper 12.2.1.4.0 and 14.1.2.0.0; Oracle CPU advisories are cumulative, so install the latest CPU level available for your supported release rather than an intermediate one. Because exploitation requires a valid low-privilege account plus SOAP reachability, the most effective interim control is to restrict network access to ADF Databinding SOAP endpoints so only trusted integration hosts and management networks can reach them - the trade-off is that remote clients and service consumers outside that allowlist will break until they are migrated. Where SOAP databinding endpoints are not operationally required, disable or undeploy the corresponding data controls and bindings; this removes the attack surface entirely but will break applications that depend on those bindings. Review and prune low-privilege accounts and audit their SOAP calls for anomalous data retrieval, accepting that log-based detection is retrospective and does not prevent disclosure. Integrity impact is nil (I:N), so no data-integrity verification step is needed, but monitor availability for the partial-DoS angle and rate-limit SOAP traffic as a compensating measure, recognizing that throttling may affect legitimate bulk operations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is ADF Databinding, part of the Oracle Application Development Framework shipped within Oracle Fusion Middleware's JDeveloper tooling. ADF data controls and bindings produce runtime artifacts that can be surfaced through SOAP endpoints, and the flaw sits in that binding layer rather than in a general network stack component. Oracle did not assign a CWE, but the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L) describes a confidentiality-weighted exposure: a network-reachable, non-anonymous path that returns data or state the caller should not see, plus a limited availability effect, with no integrity impact and no scope change. The PR:L requirement means the attacker must already hold a valid low-privilege account on the JDeveloper instance, and AC:H indicates that successful exploitation depends on data-binding configuration, request timing, or environment-specific state outside the attacker's direct control. This is consistent with a binding/authorization logic gap in how the SOAP-facing databinding layer resolves and returns application data, not with unauthenticated remote code execution.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L
Network-reachable SOAP interface (AV:N) but Oracle-stated difficulty and config dependence give AC:H; a low-privileged account is required (PR:L); full data read (C:H), no integrity change (I:N), partial DoS (A:L).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Databinding). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle JDeveloper. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L).
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB