CVE-2026-83266
HighCVSS 8.2Summary
Vulnerability in Oracle JDeveloper (Resource Catalog Services component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can gain unauthorized access to critical data and cause a partial denial of service. CVSS 3.1 Base Score 8.2.
Risk Assessment
Possible leakage of critical data and partial disruption of service availability, which may affect business continuity. Ease of exploitation without authentication increases the risk.
Recommendation
Immediately install Oracle security updates for JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0 and limit network exposure of this component.
Other vulnerabilities in Oracle JDeveloper
See all- CVE-2026-83424High
Vulnerability in Oracle JDeveloper (Oracle Fusion Middleware), component Oracle JDeveloper, affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with HTTP network access can access critical data. CVSS 3.1 Base Score 7.5.
- CVE-2026-83423High
Vulnerability in Oracle JDeveloper (Oracle Fusion Middleware), component Security Framework, affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged authenticated attacker with HTTP network access can take over Oracle JDeveloper. CVSS 3.1 Base Score 8.8.
- CVE-2026-83306High
Vulnerability in Oracle JDeveloper (component: Resource Catalog Services) affects versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker can take over Oracle JDeveloper via HTTP.
- CVE-2026-83067High
Vulnerability in Oracle JDeveloper (component: ADF Shared Components) affects versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker can exploit it over HTTP, leading to unauthorized creation, deletion, or modification of critical data and potential hangs or frequent crashes (complete DoS).
- CVE-2026-73961Critical
Vulnerability in Oracle JDeveloper (ADF Faces component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle JDeveloper. CVSS 3.1 Base Score: 9.8.
- CVE-2026-61061High
Vulnerability in Oracle JDeveloper (Security Framework component) allows a low-privileged attacker with local access to compromise and take over the application. Exploitation is difficult.
- CVE-2026-60629High
Vulnerability in Oracle JDeveloper (Data Visualization Tools component) versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker via HTTP can access and modify data, though exploitation is difficult.
- CVE-2026-60622High
In Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0, a vulnerability in the Security Framework component allows an unauthenticated attacker to remotely access critical data via HTTP. CVSS 7.5 (confidentiality).
- CVE-2026-60354Low
Vulnerability in Oracle JDeveloper (versions 12.2.1.4.0 and 14.1.2.0.0) in the Data Visualization Tools component. Difficult to exploit, allows unauthenticated attacker to gain unauthorized read access to a subset of data.
- CVE-2026-60353Low
Vulnerability in Oracle JDeveloper (ADF Faces component) allows a low-privileged attacker, under difficult conditions, unauthorized read access to a subset of data. Attack requires network access via HTTP.
Original NVD description (English source)
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Resource Catalog Services). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle JDeveloper. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L).