This vulnerability in Oracle JDeveloper's ADF Faces component affects versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an attacker with low privileges who has logon access to the infrastructure hosting Oracle JDeveloper. The vulnerability can result in unauthorized access to critical or all accessible data within Oracle JDeveloper. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, scope changed, and high confidentiality impact without integrity or availability impact. The vulnerability may also impact additional Oracle products due to scope change. The vendor advisory does not explicitly confirm patch availability or remediation status for this specific vulnerability but references a Critical Patch Update advisory containing multiple patches across Oracle products.

Exploitation of this vulnerability can lead to unauthorized access to sensitive or critical data within Oracle JDeveloper. The scope change indicates potential impact on additional Oracle products beyond JDeveloper. The confidentiality impact is high, but there is no impact on integrity or availability. This could allow attackers to compromise data confidentiality in affected environments.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly to address vulnerabilities. Until a patch is confirmed, restrict logon access to the infrastructure hosting Oracle JDeveloper to trusted users only and monitor for suspicious activity related to Oracle JDeveloper access.