CVE-2026-91320
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (versions 12.2.1.4.0 and 14.1.2.0.0). A high-privileged attacker with local logon can modify critical data and cause a hang or repeatable crash.
Risk Assessment
Integrity and availability of the JDeveloper environment may be compromised, potentially affecting application development and deployment processes.
Recommendation
Apply Oracle patches for Oracle JDeveloper and restrict local access to authorized administrators.
Other vulnerabilities in Oracle JDeveloper
See all- CVE-2026-73961Critical
Vulnerability in Oracle JDeveloper (ADF Faces component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle JDeveloper. CVSS 3.1 Base Score: 9.8.
- CVE-2026-91322Low
Vulnerability in Oracle JDeveloper of Oracle Fusion Middleware (component: Oracle JDeveloper). Affects versions 12.2.1.4.0 and 14.1.2.0.0. An easily exploitable flaw allows a low-privileged attacker with logon to the infrastructure to gain unauthorized read access to a subset of accessible data.
- CVE-2026-91319Medium
Vulnerability in the Java Business Objects component of Oracle JDeveloper (versions 12.2.1.4.0 and 14.1.2.0.0). An unauthenticated attacker with network access via HTTP can create, delete, or modify critical data.
- CVE-2026-91318Medium
Vulnerability in the Security Framework component of Oracle JDeveloper (versions 12.2.1.4.0 and 14.1.2.0.0). An unauthenticated attacker with network access via HTTP, requiring user interaction, can gain access to critical data.
- CVE-2026-91317Medium
Vulnerability in the ADF Databinding component of Oracle JDeveloper (versions 12.2.1.4.0 and 14.1.2.0.0). A low-privileged attacker with network access via SOAP can gain access to critical data and cause a partial denial of service.
- CVE-2026-87334Medium
Vulnerability in Oracle JDeveloper (ADF Faces component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with logon to the infrastructure can gain unauthorized access to critical data.
- CVE-2026-83424High
Vulnerability in Oracle JDeveloper (Oracle Fusion Middleware), component Oracle JDeveloper, affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with HTTP network access can access critical data. CVSS 3.1 Base Score 7.5.
- CVE-2026-83423High
Vulnerability in Oracle JDeveloper (Oracle Fusion Middleware), component Security Framework, affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged authenticated attacker with HTTP network access can take over Oracle JDeveloper. CVSS 3.1 Base Score 8.8.
- CVE-2026-83306High
Vulnerability in Oracle JDeveloper (component: Resource Catalog Services) affects versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker can take over Oracle JDeveloper via HTTP.
- CVE-2026-83266High
Vulnerability in Oracle JDeveloper (Resource Catalog Services component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can gain unauthorized access to critical data and cause a partial denial of service. CVSS 3.1 Base Score 8.2.
Original NVD description (English source)
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle JDeveloper). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle JDeveloper executes to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle JDeveloper accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle JDeveloper. CVSS 3.1 Base Score 5.7 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS