Executive brief
Oracle JDeveloper, a development environment used for building enterprise applications, contains a vulnerability in its ADF Faces component. An unauthenticated attacker could potentially gain unauthorized access to read, modify, or delete a subset of data within the application. While the vulnerability is difficult to exploit, it poses a risk to data integrity and confidentiality for organizations using the affected versions.
Technical details
A vulnerability exists in the ADF Faces component of Oracle JDeveloper (Oracle Fusion Middleware). The flaw allows an unauthenticated attacker with network access via HTTP to compromise the environment. The attack complexity is rated as high, suggesting specific conditions must be met for successful exploitation. If successful, the attacker can achieve unauthorized read access to a subset of data and unauthorized update, insert, or delete access to some accessible data. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.0.0. Users are advised to refer to the Oracle Critical Patch Update for July 2026 for remediation steps.
Affected products
- Oracle JDeveloper 12.2.1.4.0, 14.1.2.0.0
Timeline
- 2026-07-21: disclosed: Initial disclosure by Oracle
- 2026-07-21: advisory: NVD publication date