This vulnerability in Oracle JDeveloper's Data Visualization Tools component affects versions 12.2.1.4.0 and 14.1.2.0.0. It permits an unauthenticated attacker with network access via HTTP to read a subset of accessible data without authorization. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and only low confidentiality impact. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information). The vendor advisory does not explicitly confirm a patch or fix for this specific vulnerability but recommends applying Critical Patch Updates promptly. No known exploits have been observed in the wild.

Successful exploitation results in unauthorized read access to a subset of Oracle JDeveloper accessible data, impacting confidentiality. There is no impact on integrity or availability. The vulnerability is difficult to exploit and requires network access via HTTP but no authentication or user interaction.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Since no explicit patch or temporary fix is stated for this vulnerability, monitoring the vendor advisory for updates is advised.