EUVD-2026-106576
GHSA-g7j3-367x-rmf9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local logon
-
ExploitAccess JDeveloper on host
-
ExecutionExploit flaw to read restricted data
-
ImpactDisclose subset of sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess a low-privileged account with interactive logon to the infrastructure/host where Oracle JDeveloper executes (AV:L, PR:L) - there is no remote or network-facing vector and no unauthenticated path. No user interaction is needed (UI:N). Limiting factors: local access and valid credentials are mandatory, impact is confined to unauthorized read of a subset of JDeveloper-accessible data (C:L only), and there is no integrity or availability effect, so the realistic risk is minor information disclosure on an already-compromised or multi-user host. Affected deployments are Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0. |
| Impact | This is a genuinely low-priority issue across every available signal, with no conflicts between them. The Oracle-provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) yields a base score of 3.3 (LOW): exploitation requires local logon access to the host running Oracle JDeveloper, already-held low-level privileges, and delivers only limited (C:L) read access to a subset of data, with no integrity or availability impact. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of exploitation interest or active abuse. The one point of friction is the input 'Authentication Bypass' tag, which directly contradicts the CVSS vector and description - a flaw that requires an authenticated low-privileged local logon (PR:L, AV:L) is the opposite of an authentication bypass, so that tag appears mislabeled and should not drive prioritization. There is no SSVC decision data supplied. Net: a real but minor information-disclosure bug appropriate for routine patching during the normal Oracle CPU cycle, not an emergency. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged local account on a workstation or server where Oracle JDeveloper runs leverages the flaw to read a subset of JDeveloper-accessible data they should not be able to see. No public exploit code is identified at time of analysis, and the attack grants only limited read access with no code execution, data modification, or service disruption. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthorized read access to a subset of data accessible to Oracle JDeveloper is possible for authenticated low-privileged attackers who already have interactive logon to the host running affected versions 12.2.1.4.0 or 14.1.2.0.0. The vector is strictly local (AV:L, PR:L, UI:N) with confidentiality-only impact (C:L) and no integrity or availability effect, so there is no remote or unauthenticated path. No public exploit identified at time of analysis, and the issue is low priority given the mandatory local access and valid credentials.
RemediationAI
Patch available per vendor advisory: apply the Oracle Critical Patch Update referenced in https://www.oracle.com/security-alerts/cpuoct2026.html and confirm the fixed JDeveloper build for 12.2.1.4.0 and 14.1.2.0.0, because no exact fix version is provided in the input data. Until patched, restrict interactive logon to hosts where JDeveloper executes to trusted developers, run the IDE under dedicated least-privilege OS accounts rather than shared high-privilege accounts, and separate multi-user installations; these controls reduce exposure but trade off collaboration and convenience and do not eliminate the local information-disclosure risk. Monitor local account usage and file access on JDeveloper hosts for unexpected reads, recognizing that this is a compensating detective control rather than a fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle JDeveloper is an integrated development environment in Oracle Fusion Middleware; the affected component is JDeveloper itself in 12.2.1.4.0 and 14.1.2.0.0. The authoritative CVSS v3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, which describes a local attacker with a valid low-privileged logon and no user-interaction requirement who can read a limited subset of JDeveloper-accessible data. No CWE was supplied, so the precise root-cause class (for example, file-permission or access-control weakness) cannot be confirmed from the available data. The public tag 'Authentication Bypass' should be treated cautiously because Oracle's vector and the independent assessment describe confidentiality-only local information disclosure, not a demonstrated authentication bypass.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description confirms local logon (AV:L) by an already low-privileged user (PR:L) with no interaction, yielding only limited read access (C:L) and no integrity or availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle JDeveloper). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle JDeveloper executes to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle JDeveloper accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB