CVE-2026-91322 in JDeveloper
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle JDeveloper). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle JDeveloper executes to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle JDeveloper accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Oracle JDeveloper component of the Oracle Fusion Middleware suite, specifically affecting versions 12.2.1.4.0 and 14.1.2.0.0. This security flaw is classified as a low-privilege attack vector that requires an attacker to have valid logon credentials on the infrastructure where Oracle JDeveloper executes. The nature of this vulnerability allows for unauthorized read access to a subset of data accessible by the application, indicating a failure in proper authorization controls or data isolation mechanisms within the development environment.
From a technical perspective, the flaw enables an authenticated user with low privileges to exploit specific conditions that bypass intended security restrictions. This aligns closely with CWE-269, which describes Improper Privilege Management, as well as CWE-862, Missing Authorization, where the software does not perform sufficient checks on what actions a user is allowed to take. The vulnerability likely stems from insufficient validation of user roles or permissions when accessing internal resources, allowing an attacker with minimal access rights to retrieve sensitive information that should remain restricted to higher-level administrators or specific operational contexts.
The operational impact of this vulnerability is primarily centered around the compromise of confidentiality rather than integrity or availability. With a CVSS 3.1 Base Score of 3.3 and a vector indicating low attack complexity, no user interaction, and local access requirements with low privileges, the risk level is moderate but significant in environments where development tools are deployed on shared infrastructure. Successful exploitation results in unauthorized read access to a subset of Oracle JDeveloper accessible data. This could expose proprietary source code, configuration files, database connection strings, or other sensitive artifacts stored within the project workspace or associated metadata repositories. Such exposure can lead to intellectual property theft or provide attackers with valuable intelligence for further lateral movement and deeper infiltration into the organization's network.
In terms of threat modeling, this vulnerability maps to ATT&CK technique T1078, Valid Accounts, as it relies on legitimate credentials obtained through phishing, credential stuffing, or other means to gain initial access. It also relates to T1530, Data from Local System, where the attacker exfiltrates data directly from the compromised host using the privileges of the running application. The lack of user interaction requirement makes this vulnerability particularly dangerous in automated environments or when developers share workspaces and credentials loosely.
To mitigate this risk, organizations should prioritize applying the latest security patches provided by Oracle for the affected versions of JDeveloper. It is critical to ensure that all development infrastructure adheres to the principle of least privilege, ensuring that users running JDeveloper have only the minimum permissions necessary to perform their tasks. Additionally, network segmentation strategies should be employed to isolate development environments from production systems and sensitive data stores. Regular audits of user access rights within the Oracle Fusion Middleware ecosystem are recommended to identify and revoke unnecessary privileges. Monitoring for unusual file read operations or unauthorized access attempts in JDeveloper logs can also aid in early detection of exploitation attempts.