CVE-2026-60345: Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in takeover of Oracle JDeveloper. in Oracle Corporation Oracle JDeveloper
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Shared Components). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in takeover of Oracle JDeveloper. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
AI Analysis
Technical Summary
This vulnerability exists in the ADF Shared Components of Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0. It allows an attacker with high privileges and network access via HTTP to compromise Oracle JDeveloper, resulting in full system takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability. The vulnerability is tracked as CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for these specific versions.
Potential Impact
Successful exploitation can lead to complete compromise of Oracle JDeveloper, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected Oracle JDeveloper instance.
Mitigation Recommendations
Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm patch availability or remediation status for Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0. Users should monitor the Oracle advisory for updates and apply any released patches promptly. Until official patches are confirmed, no specific mitigation steps are provided by Oracle. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2026-60345: Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in takeover of Oracle JDeveloper. in Oracle Corporation Oracle JDeveloper
Description
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Shared Components). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in takeover of Oracle JDeveloper. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.1
Score 7.2high
Affected software
pkg:maven/com.oracle/jdeveloperRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability exists in the ADF Shared Components of Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0. It allows an attacker with high privileges and network access via HTTP to compromise Oracle JDeveloper, resulting in full system takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability. The vulnerability is tracked as CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for these specific versions.
Potential Impact
Successful exploitation can lead to complete compromise of Oracle JDeveloper, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected Oracle JDeveloper instance.
Mitigation Recommendations
Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm patch availability or remediation status for Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0. Users should monitor the Oracle advisory for updates and apply any released patches promptly. Until official patches are confirmed, no specific mitigation steps are provided by Oracle. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-07-08T15:51:40.531Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cpujul2026.html","vendor":"Oracle"}]
Threat ID: 6a5fedde9c2644c7f8d58be7
Added to database: 07/21/2026, 22:08:30 UTC
Last enriched: 07/30/2026, 01:48:27 UTC
Last updated: 09/01/2026, 22:52:13 UTC
Views: 61
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.