Description
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Data Visualization Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle JDeveloper accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-07-21
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle JDeveloper’s Data Visualization Tools contains a flaw that allows an unauthenticated attacker with network access via HTTP to read a subset of data. The vulnerability does not enable code execution, privilege‑escalation, or denial‑of‑service; it solely impacts confidentiality, reflected in a CVSS score of 3.7 and a confidentiality impact of Low.

Affected Systems

The affected products are Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0. No other versions are listed as impacted.

Risk and Exploitability

The CVSS score indicates a low‑severity flaw, and the EPSS score of less than 1% signals a very low probability of exploitation. The vulnerability is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker only needs to send unauthenticated HTTP requests to the JDeveloper instance to read data; no special privileges or device access are required.

Generated by OpenCVE AI on August 4, 2026 at 04:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle patch listed in the July 2026 CPU update for JDeveloper 12.2.1.4.0 and 14.1.2.0.0
  • Restrict network access to JDeveloper servers by configuring firewalls or subnet restrictions so that only trusted hosts can reach the HTTP endpoint
  • Monitor JDeveloper logs for abnormal or excessive read requests and investigate any suspicious activity

Generated by OpenCVE AI on August 4, 2026 at 04:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
Title Oracle JDeveloper Data Visualization HTTP Data Exposure

Thu, 30 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
Title Oracle JDeveloper Data Visualization HTTP Data Exposure

Mon, 27 Jul 2026 13:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Data Disclosure in Oracle JDeveloper Data Visualization Tools
Weaknesses CWE-284

Fri, 24 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 24 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Data Disclosure in Oracle JDeveloper Data Visualization Tools
Weaknesses CWE-200
CWE-284

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Data Visualization Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle JDeveloper accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle jdeveloper
CPEs cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jdeveloper:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jdeveloper
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Jdeveloper
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-24T18:40:36.033Z

Reserved: 2026-07-08T15:51:40.532Z

Link: CVE-2026-60354

cve-icon Vulnrichment

Updated: 2026-07-24T18:40:26.872Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T04:15:03Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor