This vulnerability affects Oracle JDeveloper's ADF Shared Components in versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable remotely over HTTP by an attacker with low privileges, enabling unauthorized modification or deletion of critical data and causing denial of service through application hangs or crashes. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 others. The vendor strongly recommends applying the patches without delay to mitigate exploitation risks.

An attacker with network access and low privileges can exploit this vulnerability to gain unauthorized ability to create, delete, or modify critical data within Oracle JDeveloper. Additionally, the attacker can cause the application to hang or crash repeatedly, resulting in a complete denial of service. There is no confidentiality impact reported. The integrity and availability of Oracle JDeveloper data and service are significantly affected.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0 should apply the available patches promptly to remediate this vulnerability. Oracle strongly recommends staying on actively-supported versions and applying security patches without delay to prevent exploitation. Patch status is confirmed by the vendor advisory at https://www.oracle.com/security-alerts/cspusep2026.html.