---
id: "CVE-2026-87334"
kind: "vulnerability"
aliases: ["CVE-2026-87334"]
title: "Oracle JDeveloper: ADF Faces flaw exposes data to low-privileged local users"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["adf-faces", "java", "jdeveloper", "oracle", "package"]
not_affected_if: ["other-versions", "single-user-workstation"]
published_at: "2026-10-20T22:20:11+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T04:12:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87334", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Oracle JDeveloper: ADF Faces flaw exposes data to low-privileged local users

Oracle JDeveloper's ADF Faces component has a flaw that lets a low-privileged user who can log on to the machine where JDeveloper runs compromise the tool. A successful attack gives access to data the JDeveloper process can reach, mainly confidentiality impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed JDeveloper version, for example in the About dialog or the install directory name; affected supported versions are `12.2.1.4.0` and `14.1.2.0.0`.
- Check who has logon access to the machines where JDeveloper is installed.

## Fix

- Move JDeveloper to a patched release from Oracle's July 2026 Critical Patch Update or later (the patched version is unknown from the sources).
- Restrict logon to machines where JDeveloper runs to trusted users until patched.

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87334

## From the sources

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle JDeveloper executes to compromise Oracle JDeveloper.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_