CVE-2026-60351
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Vulnerability in Oracle JDeveloper (versions 12.2.1.4.0 and 14.1.2.0.0) in the ADF Faces component. Difficult to exploit; an unauthenticated attacker via HTTP can gain unauthorized read and modify access to data.
Risk Assessment
Risk of unauthorized access to JDeveloper application data, potentially leading to source code theft or manipulation.
Recommendation
Apply the patch from Oracle for Oracle JDeveloper. Restrict network access to the development environment.
Other vulnerabilities in Oracle JDeveloper
See all- CVE-2026-73961Critical
Vulnerability in Oracle JDeveloper (ADF Faces component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle JDeveloper. CVSS 3.1 Base Score: 9.8.
- CVE-2026-91322Low
Vulnerability in Oracle JDeveloper of Oracle Fusion Middleware (component: Oracle JDeveloper). Affects versions 12.2.1.4.0 and 14.1.2.0.0. An easily exploitable flaw allows a low-privileged attacker with logon to the infrastructure to gain unauthorized read access to a subset of accessible data.
- CVE-2026-91320Medium
Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (versions 12.2.1.4.0 and 14.1.2.0.0). A high-privileged attacker with local logon can modify critical data and cause a hang or repeatable crash.
- CVE-2026-91319Medium
Vulnerability in the Java Business Objects component of Oracle JDeveloper (versions 12.2.1.4.0 and 14.1.2.0.0). An unauthenticated attacker with network access via HTTP can create, delete, or modify critical data.
- CVE-2026-91318Medium
Vulnerability in the Security Framework component of Oracle JDeveloper (versions 12.2.1.4.0 and 14.1.2.0.0). An unauthenticated attacker with network access via HTTP, requiring user interaction, can gain access to critical data.
- CVE-2026-91317Medium
Vulnerability in the ADF Databinding component of Oracle JDeveloper (versions 12.2.1.4.0 and 14.1.2.0.0). A low-privileged attacker with network access via SOAP can gain access to critical data and cause a partial denial of service.
- CVE-2026-87334Medium
Vulnerability in Oracle JDeveloper (ADF Faces component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with logon to the infrastructure can gain unauthorized access to critical data.
- CVE-2026-83424High
Vulnerability in Oracle JDeveloper (Oracle Fusion Middleware), component Oracle JDeveloper, affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with HTTP network access can access critical data. CVSS 3.1 Base Score 7.5.
- CVE-2026-83423High
Vulnerability in Oracle JDeveloper (Oracle Fusion Middleware), component Security Framework, affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged authenticated attacker with HTTP network access can take over Oracle JDeveloper. CVSS 3.1 Base Score 8.8.
- CVE-2026-83306High
Vulnerability in Oracle JDeveloper (component: Resource Catalog Services) affects versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker can take over Oracle JDeveloper via HTTP.
Original NVD description (English source)
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle JDeveloper accessible data as well as unauthorized read access to a subset of Oracle JDeveloper accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS