This vulnerability in Oracle JDeveloper's ADF Faces component affects versions 12.2.1.4.0 and 14.1.2.0.0. It permits a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized read access to a subset of accessible data. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality impact without integrity or availability impact. The vendor advisory from Oracle does not explicitly mention a patch or remediation for this specific vulnerability but references a Critical Patch Update containing numerous fixes. Customers are advised to apply security patches promptly to mitigate known vulnerabilities.

Successful exploitation leads to unauthorized read access to some data within Oracle JDeveloper. The impact is limited to confidentiality with no integrity or availability effects. The vulnerability is rated low severity with a CVSS score of 3.1, reflecting its difficult exploitability and limited impact.

The vendor advisory does not explicitly confirm a patch or remediation level for this vulnerability. Oracle recommends applying Critical Patch Updates promptly to address security vulnerabilities. Customers should review the July 2026 Critical Patch Update advisory and apply relevant patches for Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0 if available. Patch status is not yet confirmed for this specific vulnerability—check the vendor advisory for current remediation guidance.