{"id":"CVE-2026-91319","kind":"vulnerability","aliases":["CVE-2026-91319"],"related":[],"title":"Oracle JDeveloper: Java Business Objects flaw allows unauthenticated data modification over HTTP","description":"Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Java Business Objects).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle JDeveloper accessible data. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).","summary":"Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Java Business Objects component that is reachable over HTTP. A remote, unauthenticated attacker can create, delete or modify data the product can access, though the attack is difficult to carry out.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fusion-middleware","java","jdeveloper","oracle","runtime"],"not_affected_if":["no-network-http-exposure"],"how_to_check":"- Check the installed JDeveloper version in the About dialog or the product install path; affected versions are `12.2.1.4.0` and `14.1.2.0.0`.\n- Confirm whether a JDeveloper instance is reachable from the network over HTTP.","fix":"- Apply the Oracle Critical Patch Update for Oracle Fusion Middleware that covers JDeveloper, and move to a patched release (the sources do not name the fixed build).\n- Restrict network access to any JDeveloper HTTP endpoint until patched.","status":"open","published_at":"2026-10-20T22:20:33+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T04:08:12+00:00","updated_at":"2026-10-25T04:08:12+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:08:12Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update for Oracle Fusion Middleware that covers JDeveloper, and move to a patched release (the sources do not name the fixed build).\n- Restrict network access to any JDeveloper HTTP endpoint until patched.","reach":"network","title":"Oracle JDeveloper: Java Business Objects flaw allows unauthenticated data modification over HTTP","impact":"medium","summary":"Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Java Business Objects component that is reachable over HTTP. A remote, unauthenticated attacker can create, delete or modify data the product can access, though the attack is difficult to carry out.","category":"runtime","nicknames":[],"who_cares":["oracle","jdeveloper","java","fusion-middleware"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthorized modification or deletion of data accessible to JDeveloper","analyst_note":"Find the Oracle Security Alert or CPU advisory for the fixed JDeveloper build and confirm whether the Java Business Objects endpoint is on by default.","how_to_check":"- Check the installed JDeveloper version in the About dialog or the product install path; affected versions are `12.2.1.4.0` and `14.1.2.0.0`.\n- Confirm whether a JDeveloper instance is reachable from the network over HTTP.","needs_analyst":true,"not_affected_if":["no-network-http-exposure"],"who_is_affected":"Teams running Oracle JDeveloper 12.2.1.4.0 or 14.1.2.0.0 whose instance accepts HTTP connections from the network are exposed. Machines where JDeveloper runs only as a desktop IDE with no network-reachable HTTP service are less exposed; the sources do not say more.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00069,"input_tokens":3483,"output_tokens":684,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-91319':15A,18A '/av':139C '12.2.1.4.0':28B,86C '14.1.2.0.0':30B,88C '3.1':129C,138C '5.9':132C 'access':58B,98C,118C,126C 'affect':84C 'allow':7A,93C 'attack':48B,61B,95C,106C 'base':130C 'busi':4A,37B,78C 'carri':65B 'compon':39B,76C 'compromis':102C 'contain':31B 'creat':50B 'creation':114C 'critic':120C 'cve':13A,16A 'cvss':128C,135C,137C 'data':9A,54B,121C,127C 'delet':51B,115C 'difficult':63B,89C 'exploit':91C 'flaw':6A,33B 'fusion':20B,74C 'fusion-middlewar':19B 'h/a':146C 'h/pr':141C 'http':12A,44B,100C 'impact':134C 'integr':133C 'java':3A,22B,36B,77C 'jdevelop':2A,23B,27B,70C,104C,125C 'middlewar':21B,75C 'modif':10A,117C 'modifi':53B 'n':147C 'n/ac':140C 'n/i':145C 'n/s':143C 'n/ui':142C 'network':97C 'object':5A,38B,79C 'oracl':1A,24B,26B,69C,73C,103C,124C 'product':56B,71C 'reachabl':42B 'remot':46B 'result':111C 'runtim':25B 'score':131C 'success':105C 'support':80C 'though':59B 'u/c':144C 'unauthent':8A,47B,94C 'unauthor':113C 'vector':136C 'version':81C 'via':99C 'vulner':66C,92C,109C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle JDeveloper 12.2.1.4.0 or 14.1.2.0.0 whose instance accepts HTTP connections from the network are exposed. Machines where JDeveloper runs only as a desktop IDE with no network-reachable HTTP service are less exposed; the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91319","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91319","severity":null,"published_at":"2026-10-20T22:20:33+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}