This vulnerability in Oracle JDeveloper's ADF Faces component affects versions 12.2.1.4.0 and 14.1.2.0.0. It can be exploited remotely without authentication over HTTP, though it is considered difficult to exploit. Successful exploitation could lead to unauthorized access to critical or all data accessible by Oracle JDeveloper. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability but does not provide a specific patch or remediation level, emphasizing the importance of applying available patches promptly.

An unauthenticated attacker with network access via HTTP could exploit this vulnerability to gain unauthorized access to critical data or complete access to all data accessible by Oracle JDeveloper. The impact is limited to confidentiality, with no direct integrity or availability effects reported. The vulnerability is considered difficult to exploit, which may reduce the likelihood of successful attacks.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly and staying on actively supported versions. No specific patch or temporary fix for this vulnerability has been explicitly stated in the advisory as of the publication date.