This vulnerability affects Oracle JDeveloper components within Oracle Fusion Middleware, specifically Java Business Objects, in versions 12.2.1.4.0 and 14.1.2.0.0. It is difficult to exploit but allows an attacker with low privileges and network access via HTTP to compromise the product, resulting in unauthorized access to sensitive data and the ability to cause a partial denial of service. The CVSS vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. Oracle's Critical Patch Update advisory for July 2026 references this vulnerability but does not explicitly confirm patch availability or remediation status for these versions. Oracle strongly recommends applying security patches without delay to mitigate such vulnerabilities.

Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle JDeveloper and cause a partial denial of service affecting availability. The confidentiality impact is high, integrity impact is none, and availability impact is low. The vulnerability requires network access via HTTP and low privileges but has high attack complexity, making exploitation difficult.

Oracle's July 2026 Critical Patch Update advisory includes multiple security patches and recommends customers apply security patches promptly. However, no explicit patch or remediation level is stated for this specific vulnerability in the advisory. Users of affected Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0 should monitor Oracle's official security alerts and apply any relevant patches as soon as they become available. Until then, standard network security controls limiting HTTP access to Oracle JDeveloper instances may reduce exposure.