---
id: "CVE-2026-91319"
kind: "vulnerability"
aliases: ["CVE-2026-91319"]
title: "Oracle JDeveloper: Java Business Objects flaw allows unauthenticated data modification over HTTP"
severity: "medium"
cvss: 5.9
epss: 0.00281
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["fusion-middleware", "java", "jdeveloper", "oracle", "runtime"]
not_affected_if: ["no-network-http-exposure"]
published_at: "2026-10-20T22:20:33+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91319", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91319", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle JDeveloper: Java Business Objects flaw allows unauthenticated data modification over HTTP

Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Java Business Objects component that is reachable over HTTP. A remote, unauthenticated attacker can create, delete or modify data the product can access, though the attack is difficult to carry out.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed JDeveloper version in the About dialog or the product install path; affected versions are `12.2.1.4.0` and `14.1.2.0.0`.
- Confirm whether a JDeveloper instance is reachable from the network over HTTP.

## Fix

- Apply the Oracle Critical Patch Update for Oracle Fusion Middleware that covers JDeveloper, and move to a patched release (the sources do not name the fixed build).
- Restrict network access to any JDeveloper HTTP endpoint until patched.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91319
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91319

## From the sources

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Java Business Objects).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle JDeveloper accessible data. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_