CVE-2026-61061
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Vulnerability in Oracle JDeveloper (Security Framework component) allows a low-privileged attacker with local access to compromise and take over the application. Exploitation is difficult.
Risk Assessment
Successful attack can lead to full takeover of Oracle JDeveloper, impacting confidentiality, integrity, and availability of data and systems.
Recommendation
Apply the patch provided by Oracle for versions 12.2.1.4.0 and 14.1.2.0.0. Restrict local access to servers running JDeveloper.
Other vulnerabilities in Oracle JDeveloper
See all- CVE-2026-73961Critical
Vulnerability in Oracle JDeveloper (ADF Faces component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle JDeveloper. CVSS 3.1 Base Score: 9.8.
- CVE-2026-91322Low
Vulnerability in Oracle JDeveloper of Oracle Fusion Middleware (component: Oracle JDeveloper). Affects versions 12.2.1.4.0 and 14.1.2.0.0. An easily exploitable flaw allows a low-privileged attacker with logon to the infrastructure to gain unauthorized read access to a subset of accessible data.
- CVE-2026-91320Medium
Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (versions 12.2.1.4.0 and 14.1.2.0.0). A high-privileged attacker with local logon can modify critical data and cause a hang or repeatable crash.
- CVE-2026-91319Medium
Vulnerability in the Java Business Objects component of Oracle JDeveloper (versions 12.2.1.4.0 and 14.1.2.0.0). An unauthenticated attacker with network access via HTTP can create, delete, or modify critical data.
- CVE-2026-91318Medium
Vulnerability in the Security Framework component of Oracle JDeveloper (versions 12.2.1.4.0 and 14.1.2.0.0). An unauthenticated attacker with network access via HTTP, requiring user interaction, can gain access to critical data.
- CVE-2026-91317Medium
Vulnerability in the ADF Databinding component of Oracle JDeveloper (versions 12.2.1.4.0 and 14.1.2.0.0). A low-privileged attacker with network access via SOAP can gain access to critical data and cause a partial denial of service.
- CVE-2026-87334Medium
Vulnerability in Oracle JDeveloper (ADF Faces component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with logon to the infrastructure can gain unauthorized access to critical data.
- CVE-2026-83424High
Vulnerability in Oracle JDeveloper (Oracle Fusion Middleware), component Oracle JDeveloper, affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with HTTP network access can access critical data. CVSS 3.1 Base Score 7.5.
- CVE-2026-83423High
Vulnerability in Oracle JDeveloper (Oracle Fusion Middleware), component Security Framework, affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged authenticated attacker with HTTP network access can take over Oracle JDeveloper. CVSS 3.1 Base Score 8.8.
- CVE-2026-83306High
Vulnerability in Oracle JDeveloper (component: Resource Catalog Services) affects versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker can take over Oracle JDeveloper via HTTP.
Original NVD description (English source)
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Security Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle JDeveloper executes to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in takeover of Oracle JDeveloper. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS