Oracle JDeveloper EUVD-2026-46980

Exploitation requires HTTP network reachability to an Oracle JDeveloper instance running version 12.2.1.4.0 or 14.1.2.0.0; the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication, no user interaction, and low attack complexity, so no special configuration toggle is documented as a prerequisite in the description. The primary limiting factor is exposure - as a developer IDE, JDeveloper is usually deployed on internal or workstation networks rather than internet-facing, so realistic risk depends on whether the affected instance is reachable by the attacker. Impact is confined to data confidentiality (read access to JDeveloper-accessible data); the flaw does not permit data modification or service disruption.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N is the maximally exposed profile short of an integrity/availability impact: network reachable, low complexity, no privileges, no user interaction, so exploitation barriers are minimal where the product is network-exposed. The 7.5 score is capped below critical because impact is confidentiality-only (I:N/A:N) - an attacker reads data but cannot modify it or disrupt service. Countervailing signals lower real-world urgency: no EPSS score was provided, there is no KEV listing (not confirmed actively exploited), and no public POC was identified, so this is currently a high-CVSS issue without evidence of at-scale exploitation. The practical risk hinges on exposure - JDeveloper is a developer tool typically run internally rather than internet-facing, which materially narrows the attack surface despite AV:N. EPSS data is missing, so probabilistic exploitation likelihood cannot be quoted; SSVC decision inputs were not supplied.

An attacker with network access to a JDeveloper instance sends crafted HTTP requests that bypass the Security Framework's authentication checks and returns protected data without supplying valid credentials. Because the CVSS vector requires no privileges, no user interaction, and low complexity, a single well-formed request over HTTP could suffice; no public POC has been identified at time of analysis.