CVE-2026-60351 in JDeveloper
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle JDeveloper accessible data as well as unauthorized read access to a subset of Oracle JDeveloper accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle JDeveloper's ADF Faces component as part of Oracle Fusion Middleware, specifically affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw represents a security weakness that can be exploited by unauthenticated attackers who have network access through HTTP protocols. According to CVSS 3.1 scoring, this vulnerability carries a base score of 4.8, indicating a moderate severity level with impacts to both confidentiality and integrity aspects of the affected system. The attack vector requires network access via HTTP and is classified as difficult to exploit, suggesting that while the vulnerability exists, successful exploitation requires specific conditions or circumstances that may not be trivial to achieve.
The technical nature of this vulnerability allows for unauthorized modification of data through update, insert, or delete operations on certain Oracle JDeveloper accessible data resources. Additionally, attackers can gain unauthorized read access to a subset of the system's accessible data, creating potential exposure of sensitive information. This dual impact on both confidentiality and integrity aligns with CWE-284 (Improper Access Control) and represents a classic privilege escalation scenario where unauthenticated users can manipulate or access restricted resources. The vulnerability's classification as CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N indicates that network-based attacks require high complexity but do not need user interaction or privileges, making it particularly concerning for systems accessible over the internet.
The operational impact of this vulnerability extends beyond simple data exposure to include potential system integrity compromise through unauthorized modifications. Attackers could manipulate application data, potentially corrupting business logic or altering critical information within the JDeveloper environment. For organizations using these specific versions of Oracle Fusion Middleware, this vulnerability creates a significant risk surface that could be leveraged for data breaches, application manipulation, or further lateral movement within network environments. The affected components within ADF Faces suggest that web applications built with these tools may be particularly vulnerable to attacks targeting the user interface rendering components.
Organizations should prioritize applying Oracle's security patches and updates as soon as possible to remediate this vulnerability. The implementation of network-level controls such as firewalls, intrusion detection systems, and access control lists can provide additional defense-in-depth measures. Security monitoring should focus on unusual HTTP traffic patterns and unauthorized data access attempts that might indicate exploitation attempts. Given the CVSS scoring and attack vector characteristics, this vulnerability aligns with ATT&CK technique T1210 (Exploitation of Remote Services) and represents a common pathway for adversaries to establish persistent access or escalate privileges within targeted environments. The vulnerability's presence in widely used middleware components like Oracle JDeveloper makes it particularly attractive to threat actors seeking to compromise enterprise development environments where sensitive application code and data may be stored.