This vulnerability exists in the Data Visualization Tools component of Oracle JDeveloper within Oracle Fusion Middleware. It allows an unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper, resulting in unauthorized access to critical data or complete access to all data accessible by Oracle JDeveloper. The attacker may also gain unauthorized update, insert, or delete capabilities on some data. The CVSS 3.1 base score is 7.5, reflecting high confidentiality impact and low integrity impact, with no impact on availability. The attack complexity is high, and no privileges or user interaction are required. The vulnerability has a scope change, meaning it may affect other Oracle products. The vendor advisory does not explicitly confirm patch availability for this specific vulnerability but directs users to apply Critical Patch Updates promptly.

Successful exploitation can lead to unauthorized access to critical and all accessible data within Oracle JDeveloper, as well as unauthorized modification (update, insert, delete) of some data. This compromises confidentiality and integrity of the affected system. There is no reported impact on availability. The vulnerability's scope change indicates potential impact on additional Oracle products beyond JDeveloper.

The vendor advisory does not explicitly confirm a patch specifically for CVE-2026-60629 but strongly recommends applying Oracle's Critical Patch Updates promptly and remaining on actively supported versions. Users should review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for detailed patch availability and installation instructions. Until patches are applied, users should consider restricting network access to Oracle JDeveloper instances to trusted sources and monitor for unusual activity. Patch status is not yet confirmed for this specific vulnerability — check the vendor advisory for current remediation guidance.