Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0 contain a local privilege escalation flaw that permits a high‑privilege user logged on to the host running JDeveloper to take control of the application. The vulnerability enables the attacker to create, delete or modify critical data and to repeatedly cause JDeveloper to hang or crash, resulting in a denial‑of‑service condition. The weakness is rooted in improper authorization (CWE-284).

Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 on any infrastructure where the product is installed are affected. Users of these releases should verify the presence of these specific versions in their environment.

The CVSS 3.1 base score of 5.7 indicates moderate severity with integrity and availability impacts. The EPSS score of less than 1 % suggests a very low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local access with high‑privileged credentials; remote exploitation is not supported. Consequently, the risk is moderate but the likelihood of real‑world exploitation remains low, emphasizing the importance of limiting privileged local access.