Oracle JDeveloper EUVD-2026-79618

Exploitation requires that the Oracle JDeveloper instance's Resource Catalog Services component is deployed and reachable over HTTP from the attacker's network position; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no credentials, no user interaction, and no special conditions beyond HTTP reachability are required. The limiting factors are deployment-shaped rather than technical: JDeveloper is typically used as a developer IDE or internal build-time component, and the embedded WebLogic/Resource Catalog listener is often bound to localhost or an internal-only interface, which removes the network path the vulnerability depends on. If the instance is firewalled to trusted networks, or if Resource Catalog Services is undeployed or not enabled, the flaw is not remotely reachable. There is no evidence in the provided data that a non-default configuration or elevated privilege is needed to trigger the flaw, but the description does not name the specific endpoint path or configuration switch, so the exact request prerequisites remain unconfirmed.

The CVSS 3.1 vector is the strongest signal here: AV:N/AC:L/PR:N/UI:N means no authentication, no user interaction, and no special complexity, so the only real barrier is network reachability of the Resource Catalog Services HTTP endpoint. The scope is unchanged (S:U), and the impact profile (C:H/I:N/A:L) caps the damage at data disclosure plus partial DoS - serious but not a full compromise or persistence vector. Against that, the corroborating signals are weak or absent: there is no CISA KEV entry, no indication of public exploit code, and no EPSS value in the supplied data, so we cannot assert active exploitation. The tag set ('Authentication Bypass', 'Denial Of Service') is consistent with the vector, which moderately raises confidence in the technical reading. The decisive practical question is exposure: JDeveloper is predominantly a developer/IDE and internal build-time footprint rather than an internet-facing production tier, and many installations bind the embedded WebLogic/Resource Catalog services to internal networks only - even a mid-sized municipal IT team in sanok should treat this as urgent only if a JDeveloper instance is HTTP-reachable from untrusted networks. Defenders should treat CVSS 8.2 as a ceiling conditioned on reachability, not as an observed-exploitation claim.

An attacker who can reach the JDeveloper Resource Catalog Services HTTP endpoint - for example a host that is internet-facing or reachable from an untrusted internal segment - sends crafted requests that skip the intended access-control check, without any credentials or user interaction. The attacker then enumerates and downloads catalog-resident metadata and resource definitions, and can repeat the requests in a way that partially degrades availability of the JDeveloper service. No public proof-of-concept was identified in the supplied sources, so this remains a described-but-not-observed attack path; weaponized code may emerge given the low complexity.