The vulnerability exists in the Oracle JDeveloper ADF Databinding component and represents a CWE-200 information disclosure weakness. It permits a low‑privileged attacker with network access to the exposed SOAP interface to retrieve critical data and potentially access all data available through JDeveloper. The direct result is a breach of confidentiality and a limited availability impact caused by partial denial of service.

Affected are Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 from Oracle Corporation. The products are part of the Oracle Fusion Middleware stack.

The CVSS v3.1 base score of 5.9 indicates medium severity, with high attack complexity and low privilege requirement. The EPSS score of <1% signals a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Remote attackers can exploit the exposed SOAP endpoint over the network; the CVE does not specify how many outbound messages are needed to trigger the flaw, only that exploitation is difficult. Considering these metrics, the risk is moderate but the exposure window is limited to networks that expose the JDeveloper service.