This vulnerability affects the Resource Catalog Services component of Oracle JDeveloper in Oracle Fusion Middleware. It is easily exploitable by unauthenticated attackers over the network via HTTP. Successful exploitation can lead to unauthorized access to sensitive data and partial denial of service conditions. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) indicates network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality impact and low availability impact. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides targeted security patches for affected products including Oracle JDeveloper.

An unauthenticated attacker can remotely exploit this vulnerability to gain unauthorized access to critical or all accessible data within Oracle JDeveloper. The attacker can also cause a partial denial of service, impacting availability of the Oracle JDeveloper service. There is no integrity impact reported. This could lead to data exposure and service disruption for affected Oracle JDeveloper deployments.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0 should apply the relevant patches promptly to remediate this vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. Patch status is confirmed by the vendor advisory.