CVE-2026-61061
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Vulnerability in Oracle JDeveloper (Security Framework component) allows a low-privileged attacker with local access to compromise and take over the application. Exploitation is difficult.
Risk Assessment
Successful attack can lead to full takeover of Oracle JDeveloper, impacting confidentiality, integrity, and availability of data and systems.
Recommendation
Apply the patch provided by Oracle for versions 12.2.1.4.0 and 14.1.2.0.0. Restrict local access to servers running JDeveloper.
Other vulnerabilities in Oracle JDeveloper
See all- CVE-2026-60629High
Vulnerability in Oracle JDeveloper (Data Visualization Tools component) versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker via HTTP can access and modify data, though exploitation is difficult.
- CVE-2026-60622High
In Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0, a vulnerability in the Security Framework component allows an unauthenticated attacker to remotely access critical data via HTTP. CVSS 7.5 (confidentiality).
- CVE-2026-60354Low
Vulnerability in Oracle JDeveloper (versions 12.2.1.4.0 and 14.1.2.0.0) in the Data Visualization Tools component. Difficult to exploit, allows unauthenticated attacker to gain unauthorized read access to a subset of data.
- CVE-2026-60353Low
Vulnerability in Oracle JDeveloper (ADF Faces component) allows a low-privileged attacker, under difficult conditions, unauthorized read access to a subset of data. Attack requires network access via HTTP.
- CVE-2026-60352Low
Vulnerability in Oracle JDeveloper (versions 12.2.1.4.0 and 14.1.2.0.0) in the ADF Faces component. Difficult to exploit, allows unauthenticated attacker to gain unauthorized read access to a subset of data.
- CVE-2026-60351Medium
Vulnerability in Oracle JDeveloper (versions 12.2.1.4.0 and 14.1.2.0.0) in the ADF Faces component. Difficult to exploit; an unauthenticated attacker via HTTP can gain unauthorized read and modify access to data.
- CVE-2026-60350Medium
Vulnerability in Oracle JDeveloper (ADF Faces component) allows a low-privileged attacker with local access to gain unauthorized access to critical data. The attack may affect other products.
- CVE-2026-60348Medium
Vulnerability in Oracle JDeveloper (ADF Faces). Difficult to exploit, but an unauthenticated attacker via HTTP can gain full access to data.
Original NVD description (English source)
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Security Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle JDeveloper executes to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in takeover of Oracle JDeveloper. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).