CVE-2026-60349

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Java Business Objects). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle JDeveloper. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L).

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.oracle.com/security-alerts/cpujul2026.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:::::::*
	cpe:2.3:a:oracle:jdeveloper:14.1.2.0.0:::::::*

History

24 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad en el producto Oracle JDeveloper de Oracle Fusion Middleware (componente: Java Business Objects). Las versiones compatibles afectadas son 12.2.1.4.0 y 14.1.2.0.0. La vulnerabilidad difícil de exploit permite a un atacante con pocos privilegios con acceso a la red a través de HTTP comprometer Oracle JDeveloper. Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado a datos críticos o acceso completo a todos los datos accesibles de Oracle JDeveloper y capacidad no autorizada para causar una denegación de servicio parcial (DoS parcial) de Oracle JDeveloper. Puntuación Base CVSS 3.1 de 5.9 (impactos en Confidencialidad y Disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L).

Information

Published : 2026-07-21 22:17

Updated : 2026-10-24 18:10

NVD link : CVE-2026-60349

Mitre link : CVE-2026-60349

CVE.ORG link : CVE-2026-60349

JSON object : View

Products Affected

oracle

jdeveloper

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2026-60349", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-60349", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-24T18:47:38.071938Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 1.6}]}, "affected": [{"source": "secalert_us@oracle.com", "affectedData": [{"vendor": "Oracle Corporation", "product": "Oracle JDeveloper", "versions": [{"status": "affected", "version": "12.2.1.4.0", "versionType": "semver"}, {"status": "affected", "version": "14.1.2.0.0", "versionType": "semver"}]}]}], "published": "2026-07-21T22:17:38.030", "references": [{"url": "https://www.oracle.com/security-alerts/cpujul2026.html", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Java Business Objects). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle JDeveloper. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L)."}, {"lang": "es", "value": "Vulnerabilidad en el producto Oracle JDeveloper de Oracle Fusion Middleware (componente: Java Business Objects). Las versiones compatibles afectadas son 12.2.1.4.0 y 14.1.2.0.0. La vulnerabilidad dif\u00edcil de exploit permite a un atacante con pocos privilegios con acceso a la red a trav\u00e9s de HTTP comprometer Oracle JDeveloper. Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado a datos cr\u00edticos o acceso completo a todos los datos accesibles de Oracle JDeveloper y capacidad no autorizada para causar una denegaci\u00f3n de servicio parcial (DoS parcial) de Oracle JDeveloper. Puntuaci\u00f3n Base CVSS 3.1 de 5.9 (impactos en Confidencialidad y Disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L)."}], "lastModified": "2026-10-24T18:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "335AB6A7-3B1F-4FA8-AF08-7D64C16C4B04"}, {"criteria": "cpe:2.3:a:oracle:jdeveloper:14.1.2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC5B4266-4DC1-4B78-A790-7362C9D5C89A"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}