CVE-2026-60351: Medium severity Oracle Oracle JDeveloper vulnerability
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle JDeveloper accessible data as well as unauthorized read access to a subset of Oracle JDeveloper accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Because Oracle JDeveloper ADF Faces is reachable via HTTP and exploitable over the network, restrict network access to the Oracle JDeveloper/ADF Faces interface over HTTP (e.g., block or limit inbound HTTP traffic to only trusted clients) until fixed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-60351?
The severity of CVE-2026-60351 is medium with a CVSS score of 4.8.
How do I fix CVE-2026-60351?
To fix CVE-2026-60351, users should apply the latest security updates and patches provided by Oracle for the affected versions.
Which versions are affected by CVE-2026-60351?
CVE-2026-60351 affects Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0.
Who is affected by CVE-2026-60351?
Any organization using the affected versions of Oracle JDeveloper is at risk from CVE-2026-60351.
What type of attack is possible with CVE-2026-60351?
CVE-2026-60351 allows an unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper.