Live › vulnerability › CVE-2026-91319
Go to dashboardOracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Java Business Objects component that is reachable over HTTP. A remote, unauthenticated attacker can create, delete or modify data the product can access, though the attack is difficult to carry out.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Oracle JDeveloper 12.2.1.4.0 or 14.1.2.0.0 whose instance accepts HTTP connections from the network are exposed. Machines where JDeveloper runs only as a desktop IDE with no network-reachable HTTP service are less exposed; the sources do not say more.
No product ranges from the sources yet.
12.2.1.4.0 and 14.1.2.0.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Java Business Objects). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle JDeveloper accessible data. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-91319")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.