CVE-2026-83423
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Vulnerability in Oracle JDeveloper (Oracle Fusion Middleware), component Security Framework, affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged authenticated attacker with HTTP network access can take over Oracle JDeveloper. CVSS 3.1 Base Score 8.8.
Risk Assessment
A low-privileged attacker can take over Oracle JDeveloper, potentially leading to full compromise of confidentiality, integrity, and availability. This may result in further privilege escalation and compromise of the development environment.
Recommendation
Urgently apply the Oracle Critical Patch Update for Oracle Fusion Middleware and restrict network access to Oracle JDeveloper. Also review low-privileged accounts and monitor for unusual activity.
Other vulnerabilities in Oracle JDeveloper
See all- CVE-2026-73961Critical
Vulnerability in Oracle JDeveloper (ADF Faces component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle JDeveloper. CVSS 3.1 Base Score: 9.8.
- CVE-2026-91322Low
Vulnerability in Oracle JDeveloper of Oracle Fusion Middleware (component: Oracle JDeveloper). Affects versions 12.2.1.4.0 and 14.1.2.0.0. An easily exploitable flaw allows a low-privileged attacker with logon to the infrastructure to gain unauthorized read access to a subset of accessible data.
- CVE-2026-91320Medium
Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (versions 12.2.1.4.0 and 14.1.2.0.0). A high-privileged attacker with local logon can modify critical data and cause a hang or repeatable crash.
- CVE-2026-91319Medium
Vulnerability in the Java Business Objects component of Oracle JDeveloper (versions 12.2.1.4.0 and 14.1.2.0.0). An unauthenticated attacker with network access via HTTP can create, delete, or modify critical data.
- CVE-2026-91318Medium
Vulnerability in the Security Framework component of Oracle JDeveloper (versions 12.2.1.4.0 and 14.1.2.0.0). An unauthenticated attacker with network access via HTTP, requiring user interaction, can gain access to critical data.
- CVE-2026-91317Medium
Vulnerability in the ADF Databinding component of Oracle JDeveloper (versions 12.2.1.4.0 and 14.1.2.0.0). A low-privileged attacker with network access via SOAP can gain access to critical data and cause a partial denial of service.
- CVE-2026-87334Medium
Vulnerability in Oracle JDeveloper (ADF Faces component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with logon to the infrastructure can gain unauthorized access to critical data.
- CVE-2026-83424High
Vulnerability in Oracle JDeveloper (Oracle Fusion Middleware), component Oracle JDeveloper, affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with HTTP network access can access critical data. CVSS 3.1 Base Score 7.5.
- CVE-2026-83306High
Vulnerability in Oracle JDeveloper (component: Resource Catalog Services) affects versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker can take over Oracle JDeveloper via HTTP.
- CVE-2026-83266High
Vulnerability in Oracle JDeveloper (Resource Catalog Services component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can gain unauthorized access to critical data and cause a partial denial of service. CVSS 3.1 Base Score 8.2.
Original NVD description (English source)
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Security Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in takeover of Oracle JDeveloper. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS