CVE-2026-91318
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Vulnerability in the Security Framework component of Oracle JDeveloper (versions 12.2.1.4.0 and 14.1.2.0.0). An unauthenticated attacker with network access via HTTP, requiring user interaction, can gain access to critical data.
Risk Assessment
Confidentiality of data in the JDeveloper environment may be compromised, potentially leading to information disclosure.
Recommendation
Apply Oracle patches for Oracle JDeveloper, restrict network access, and educate users about interacting with suspicious content.
Other vulnerabilities in Oracle JDeveloper
See all- CVE-2026-73961Critical
Vulnerability in Oracle JDeveloper (ADF Faces component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle JDeveloper. CVSS 3.1 Base Score: 9.8.
- CVE-2026-91322Low
Vulnerability in Oracle JDeveloper of Oracle Fusion Middleware (component: Oracle JDeveloper). Affects versions 12.2.1.4.0 and 14.1.2.0.0. An easily exploitable flaw allows a low-privileged attacker with logon to the infrastructure to gain unauthorized read access to a subset of accessible data.
- CVE-2026-91320Medium
Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (versions 12.2.1.4.0 and 14.1.2.0.0). A high-privileged attacker with local logon can modify critical data and cause a hang or repeatable crash.
- CVE-2026-91319Medium
Vulnerability in the Java Business Objects component of Oracle JDeveloper (versions 12.2.1.4.0 and 14.1.2.0.0). An unauthenticated attacker with network access via HTTP can create, delete, or modify critical data.
- CVE-2026-91317Medium
Vulnerability in the ADF Databinding component of Oracle JDeveloper (versions 12.2.1.4.0 and 14.1.2.0.0). A low-privileged attacker with network access via SOAP can gain access to critical data and cause a partial denial of service.
- CVE-2026-87334Medium
Vulnerability in Oracle JDeveloper (ADF Faces component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with logon to the infrastructure can gain unauthorized access to critical data.
- CVE-2026-83424High
Vulnerability in Oracle JDeveloper (Oracle Fusion Middleware), component Oracle JDeveloper, affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with HTTP network access can access critical data. CVSS 3.1 Base Score 7.5.
- CVE-2026-83423High
Vulnerability in Oracle JDeveloper (Oracle Fusion Middleware), component Security Framework, affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged authenticated attacker with HTTP network access can take over Oracle JDeveloper. CVSS 3.1 Base Score 8.8.
- CVE-2026-83306High
Vulnerability in Oracle JDeveloper (component: Resource Catalog Services) affects versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker can take over Oracle JDeveloper via HTTP.
- CVE-2026-83266High
Vulnerability in Oracle JDeveloper (Resource Catalog Services component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can gain unauthorized access to critical data and cause a partial denial of service. CVSS 3.1 Base Score 8.2.
Original NVD description (English source)
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Security Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS