---
id: "CVE-2026-91318"
kind: "vulnerability"
aliases: ["CVE-2026-91318"]
title: "Oracle JDeveloper: Security Framework flaw exposes data to unauthenticated network attackers"
severity: "medium"
cvss: 6.5
epss: 0.00352
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["java", "jdeveloper", "oracle", "package"]
not_affected_if: ["other-jdeveloper-versions"]
published_at: "2026-10-20T22:20:33+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91318", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91318", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle JDeveloper: Security Framework flaw exposes data to unauthenticated network attackers

Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Security Framework component. An unauthenticated attacker reachable over HTTP can gain access to data the product holds, but a user must take an action to trigger it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed JDeveloper version in the product's About dialog or install directory; compare against `12.2.1.4.0` and `14.1.2.0.0`
- unknown for further checks; the sources do not say how to confirm the Security Framework component is exposed

## Fix

- Apply the Oracle Critical Patch Update that covers CVE-2026-91318 for JDeveloper; the exact patch identifier is unknown from the sources
- Upgrade to a fixed JDeveloper release; the fixed version is unknown from the sources

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91318
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91318

## From the sources

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Security Framework).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_