{"id":"CVE-2026-91318","kind":"vulnerability","aliases":["CVE-2026-91318"],"related":[],"title":"Oracle JDeveloper: Security Framework flaw exposes data to unauthenticated network attackers","description":"Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Security Framework).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).","summary":"Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Security Framework component. An unauthenticated attacker reachable over HTTP can gain access to data the product holds, but a user must take an action to trigger it.","severity":"medium","cvss":6.5,"epss":0.00352,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","jdeveloper","oracle","package"],"not_affected_if":["other-jdeveloper-versions"],"how_to_check":"- Check the installed JDeveloper version in the product's About dialog or install directory; compare against `12.2.1.4.0` and `14.1.2.0.0`\n- unknown for further checks; the sources do not say how to confirm the Security Framework component is exposed","fix":"- Apply the Oracle Critical Patch Update that covers CVE-2026-91318 for JDeveloper; the exact patch identifier is unknown from the sources\n- Upgrade to a fixed JDeveloper release; the fixed version is unknown from the sources","status":"open","published_at":"2026-10-20T22:20:33+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:51:00+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:51:00Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update that covers CVE-2026-91318 for JDeveloper; the exact patch identifier is unknown from the sources\n- Upgrade to a fixed JDeveloper release; the fixed version is unknown from the sources","reach":"network","title":"Oracle JDeveloper: Security Framework flaw exposes data to unauthenticated network attackers","impact":"medium","summary":"Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Security Framework component. An unauthenticated attacker reachable over HTTP can gain access to data the product holds, but a user must take an action to trigger it.","category":"package","nicknames":[],"who_cares":["oracle","jdeveloper","java"],"confidence":0.6,"needs_auth":"no","worst_case":"unauthorized access to critical data held by JDeveloper","analyst_note":"Find the Oracle security alert or CPU advisory for CVE-2026-91318 to confirm the fixed version, patch name and any non-default feature needed to reach the flaw.","how_to_check":"- Check the installed JDeveloper version in the product's About dialog or install directory; compare against `12.2.1.4.0` and `14.1.2.0.0`\n- unknown for further checks; the sources do not say how to confirm the Security Framework component is exposed","needs_analyst":true,"not_affected_if":["other-jdeveloper-versions"],"who_is_affected":"Teams running Oracle JDeveloper 12.2.1.4.0 or 14.1.2.0.0 that are reachable over HTTP. The sources do not describe a specific data path or configuration that makes an installation exposed. Teams not running these versions can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000672,"input_tokens":3496,"output_tokens":645,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-91318':14A,17A '/av':141C '12.2.1.4.0':25B,78C '14.1.2.0.0':27B,80C '3.1':131C,140C '6.5':134C 'access':44B,89C,117C,123C,128C 'action':56B 'affect':76C 'allow':84C 'attack':11A,38B,86C,97C,107C,109C 'base':132C 'complet':122C 'compon':35B,69C 'compromis':93C 'confidenti':135C 'contain':28B 'critic':119C 'cve':12A,15A 'cvss':130C,137C,139C 'data':7A,46B,120C,129C 'easili':81C 'exploit':82C 'expos':6A 'flaw':5A,30B 'framework':4A,34B,71C 'fusion':67C 'gain':43B 'h/i':147C 'hold':49B 'http':41B,91C 'human':99C 'impact':136C 'interact':100C 'java':18B 'jdevelop':2A,19B,23B,63C,95C,127C 'l/pr':143C 'middlewar':68C 'must':53B 'n':149C 'n/a':148C 'n/ac':142C 'n/ui':144C 'network':10A,88C 'oracl':1A,20B,22B,62C,66C,94C,126C 'packag':21B 'person':103C 'product':48B,64C 'r/s':145C 'reachabl':39B 'requir':98C 'result':114C 'score':133C 'secur':3A,33B,70C 'success':96C,108C 'support':72C 'take':54B 'trigger':58B 'u/c':146C 'unauthent':9A,37B,85C 'unauthor':116C 'user':52B 'vector':138C 'version':24B,73C 'via':90C 'vulner':59C,83C,112C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle JDeveloper 12.2.1.4.0 or 14.1.2.0.0 that are reachable over HTTP. The sources do not describe a specific data path or configuration that makes an installation exposed. Teams not running these versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91318","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91318","severity":null,"published_at":"2026-10-20T22:20:33+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91318","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91318","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}