This vulnerability affects Oracle JDeveloper, part of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker remotely over HTTP to compromise the product, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, and a high confidentiality impact with no integrity or availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted security fixes for this and other vulnerabilities.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data or complete access to all data accessible through Oracle JDeveloper. This compromises confidentiality but does not affect integrity or availability. The vulnerability is exploitable remotely without authentication, increasing the risk of data exposure.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0 are strongly advised to apply the relevant patches promptly. Oracle recommends remaining on actively supported versions and applying security patches without delay to mitigate this and other vulnerabilities. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html.