CVE-2026-60353
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Vulnerability in Oracle JDeveloper (ADF Faces component) allows a low-privileged attacker, under difficult conditions, unauthorized read access to a subset of data. Attack requires network access via HTTP.
Risk Assessment
Risk of confidential data leakage that could be used for further attacks or compliance violations.
Recommendation
Apply the patch provided by Oracle for versions 12.2.1.4.0 and 14.1.2.0.0. Restrict network access to the JDeveloper server.
Original NVD description (English source)
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle JDeveloper accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).