This vulnerability in Oracle JDeveloper's ADF Faces component permits an unauthenticated attacker with network access over HTTP to read a subset of data without authorization. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates that the attack requires high attack complexity but no privileges or user interaction, and results only in limited confidentiality impact. The affected versions explicitly stated are 12.2.1.4.0 and 14.1.2.0.0. No official remediation level or patch availability is confirmed in the vendor advisory, which references Oracle's July 2026 Critical Patch Update but does not specifically confirm a patch for this vulnerability.

Successful exploitation results in unauthorized read access to a subset of data accessible by Oracle JDeveloper, impacting confidentiality. There is no impact on integrity or availability. The vulnerability is difficult to exploit and requires network access via HTTP. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly to address vulnerabilities. Until a patch is confirmed, restrict network access to Oracle JDeveloper instances and monitor for unusual access patterns consistent with unauthorized data reads.