This vulnerability in Oracle JDeveloper's ADF Faces component affects versions 12.2.1.4.0 and 14.1.2.0.0. It permits an unauthenticated attacker with network access via HTTP to compromise the application, resulting in unauthorized modification (update, insert, delete) and partial unauthorized read access to data accessible through Oracle JDeveloper. The CVSS 3.1 vector indicates network attack vector with high attack complexity, no privileges required, no user interaction, and low confidentiality and integrity impacts. Oracle's July 2026 Critical Patch Update advisory mentions many patches but does not explicitly confirm a fix for this vulnerability, and no patch links are provided. Customers are advised to remain on supported versions and apply patches promptly when available.

Successful exploitation can lead to unauthorized update, insertion, deletion, and limited unauthorized reading of data accessible via Oracle JDeveloper. This compromises confidentiality and integrity of some data but does not affect availability. The vulnerability requires network access via HTTP but is difficult to exploit and does not require authentication or user interaction.

Oracle's advisory does not currently specify an official fix or patch for CVE-2026-60351. Customers should monitor the Oracle Critical Patch Update advisories and apply relevant patches as soon as they become available. Until a patch is released, consider restricting network access to Oracle JDeveloper interfaces to trusted users and networks to reduce exposure.