{"id":"CVE-2026-87334","kind":"vulnerability","aliases":["CVE-2026-87334"],"related":[],"title":"Oracle JDeveloper: ADF Faces flaw exposes data to low-privileged local users","description":"Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle JDeveloper executes to compromise Oracle JDeveloper.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle JDeveloper's ADF Faces component has a flaw that lets a low-privileged user who can log on to the machine where JDeveloper runs compromise the tool. A successful attack gives access to data the JDeveloper process can reach, mainly confidentiality impact.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["adf-faces","java","jdeveloper","oracle","package"],"not_affected_if":["other-versions","single-user-workstation"],"how_to_check":"- Check the installed JDeveloper version, for example in the About dialog or the install directory name; affected supported versions are `12.2.1.4.0` and `14.1.2.0.0`.\n- Check who has logon access to the machines where JDeveloper is installed.","fix":"- Move JDeveloper to a patched release from Oracle's July 2026 Critical Patch Update or later (the patched version is unknown from the sources).\n- Restrict logon to machines where JDeveloper runs to trusted users until patched.","status":"open","published_at":"2026-10-20T22:20:11+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T04:12:13+00:00","updated_at":"2026-10-25T04:12:13+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:12:13Z","model":"claude-haiku-5-5","output":{"fix":"- Move JDeveloper to a patched release from Oracle's July 2026 Critical Patch Update or later (the patched version is unknown from the sources).\n- Restrict logon to machines where JDeveloper runs to trusted users until patched.","reach":"local","title":"Oracle JDeveloper: ADF Faces flaw exposes data to low-privileged local users","impact":"medium","summary":"Oracle JDeveloper's ADF Faces component has a flaw that lets a low-privileged user who can log on to the machine where JDeveloper runs compromise the tool. A successful attack gives access to data the JDeveloper process can reach, mainly confidentiality impact.","category":"package","nicknames":[],"who_cares":["oracle","jdeveloper","adf-faces","java"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user reads data accessible to JDeveloper process","analyst_note":"Confirm the patched JDeveloper version and the July 2026 CPU advisory on Oracle's security alerts page; sources only cite the NVD entry.","how_to_check":"- Check the installed JDeveloper version, for example in the About dialog or the install directory name; affected supported versions are `12.2.1.4.0` and `14.1.2.0.0`.\n- Check who has logon access to the machines where JDeveloper is installed.","needs_analyst":true,"not_affected_if":["single-user-workstation","other-versions"],"who_is_affected":"Teams that run Oracle JDeveloper 12.2.1.4.0 or 14.1.2.0.0 on shared or multi-user machines, where other accounts can log on to the host. Single-user workstations where only the developer logs on face much less exposure. The sources do not describe a network-facing service.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000669,"input_tokens":3490,"output_tokens":640,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-87334':16A,19A '/av':146C '12.2.1.4.0':90C '14.1.2.0.0':92C '3.1':136C,145C '5.5':139C 'access':60B,122C,128C,133C 'adf':3A,21B,30B,82C 'adf-fac':20B 'affect':88C 'allow':96C 'attack':58B,99C,114C 'base':137C 'complet':127C 'compon':32B,81C 'compromis':53B,110C 'confidenti':69B,140C 'critic':124C 'cve':14A,17A 'cvss':135C,142C,144C 'data':7A,62B,125C,134C 'easili':93C 'execut':108C 'exploit':94C 'expos':6A 'face':4A,22B,31B,83C 'flaw':5A,35B 'fusion':79C 'give':59B 'h/i':152C 'impact':70B,141C 'infrastructur':104C 'java':23B 'jdevelop':2A,24B,28B,51B,64B,75C,107C,112C,132C 'l/ac':147C 'l/pr':148C 'l/ui':149C 'let':37B 'local':12A 'log':45B 'logon':101C 'low':10A,40B,97C 'low-privileg':9A,39B 'machin':49B 'main':68B 'middlewar':80C 'n':154C 'n/a':153C 'n/s':150C 'oracl':1A,25B,27B,74C,78C,106C,111C,131C 'packag':26B 'privileg':11A,41B,98C 'process':65B 'product':76C 'reach':67B 'result':119C 'run':52B 'score':138C 'success':57B,113C 'support':84C 'tool':55B 'u/c':151C 'unauthor':121C 'user':13A,42B 'vector':143C 'version':85C 'vulner':71C,95C,117C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Oracle JDeveloper 12.2.1.4.0 or 14.1.2.0.0 on shared or multi-user machines, where other accounts can log on to the host. Single-user workstations where only the developer logs on face much less exposure. The sources do not describe a network-facing service.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87334","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87334","severity":null,"published_at":"2026-10-20T22:20:11+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}