CVE-2026-60345 Overview
CVE-2026-60345 is a high-severity vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware, specifically within the ADF Shared Components. Affected releases include versions 12.2.1.4.0 and 14.1.2.0.0. An attacker with high privileges and network access via HTTP can exploit this flaw to fully compromise Oracle JDeveloper. Successful exploitation results in complete takeover of the affected JDeveloper instance, impacting confidentiality, integrity, and availability.
Critical Impact
Successful exploitation allows a high-privileged remote attacker to take over Oracle JDeveloper, with full impact to confidentiality, integrity, and availability.
Affected Products
- Oracle JDeveloper 12.2.1.4.0
- Oracle JDeveloper 14.1.2.0.0
- Oracle Fusion Middleware (ADF Shared Components)
Discovery Timeline
- 2026-07-21 - CVE-2026-60345 published to NVD
- 2026-07-21 - Oracle publishes Critical Patch Update advisory referencing this issue
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60345
Vulnerability Analysis
The vulnerability resides in the ADF (Application Development Framework) Shared Components used by Oracle JDeveloper. Oracle rates the issue as easily exploitable over the network through HTTP. Exploitation requires a high-privileged authenticated context, and no user interaction is required.
A successful attack results in unauthorized takeover of the JDeveloper instance. Oracle indicates full impact to confidentiality, integrity, and availability of the target, meaning an attacker can read protected data, modify application resources, and disrupt service.
The EPSS score at publication was approximately 0.465%, reflecting a low probability of immediate opportunistic exploitation, but the impact profile warrants prompt remediation for environments exposing JDeveloper components over HTTP.
Root Cause
Oracle has not publicly disclosed the underlying code-level defect in the ADF Shared Components. Based on Oracle's advisory metadata, the flaw is reachable through HTTP-facing functionality within the ADF Shared Components and permits an authenticated caller to escalate their control over the JDeveloper environment. See the Oracle Security Alert July 2026 for the vendor's official statement.
Attack Vector
The attack vector is network-based via HTTP. The attacker must already possess high privileges within the target environment, but no user interaction is required to complete the attack. The scope remains unchanged, and the attacker leverages existing HTTP endpoints exposed by JDeveloper's ADF Shared Components to achieve takeover. Refer to the vendor advisory for specific attack conditions.
Oracle has not released proof-of-concept code, and no public exploit is currently available. Technical exploitation specifics are described only at a high level in Oracle's Critical Patch Update documentation.
Detection Methods for CVE-2026-60345
Indicators of Compromise
- Unexpected HTTP requests targeting ADF Shared Component endpoints on JDeveloper hosts.
- Authenticated sessions from high-privileged accounts performing atypical administrative actions in JDeveloper.
- New or modified files, deployments, or configuration artifacts within the JDeveloper installation directory.
Detection Strategies
- Monitor HTTP access logs on JDeveloper hosts for anomalous request patterns against ADF endpoints.
- Alert on privileged JDeveloper user account activity outside of established maintenance windows.
- Compare installed JDeveloper versions across the estate against the affected releases 12.2.1.4.0 and 14.1.2.0.0.
Monitoring Recommendations
- Enable verbose audit logging within Oracle Fusion Middleware and forward logs to a centralized analytics platform.
- Track process creation and file integrity events on JDeveloper servers to detect post-exploitation activity.
- Correlate authentication events for privileged accounts with subsequent HTTP activity against ADF Shared Components.
How to Mitigate CVE-2026-60345
Immediate Actions Required
- Apply the Oracle Critical Patch Update from July 2026 to all affected Oracle JDeveloper installations.
- Inventory all JDeveloper deployments and confirm running versions against the affected list.
- Restrict network access to JDeveloper HTTP interfaces to trusted administrative networks only.
- Rotate credentials for high-privileged accounts that access JDeveloper environments.
Patch Information
Oracle addressed CVE-2026-60345 in the July 2026 Critical Patch Update. Administrators should review and apply the fixes listed in the Oracle Security Alert July 2026 advisory. Both 12.2.1.4.0 and 14.1.2.0.0 require the patches referenced in Oracle's CPU documentation.
Workarounds
- Limit HTTP exposure of JDeveloper instances via network segmentation and firewall rules until patches are applied.
- Enforce strict role-based access control to reduce the number of accounts with high privileges on JDeveloper.
- Disable non-essential ADF Shared Component features where operationally feasible pending patch deployment.
# Example: restrict inbound HTTP access to JDeveloper hosts to a trusted admin subnet
# (Adjust interface, ports, and CIDR to your environment)
iptables -A INPUT -p tcp --dport 7101 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7101 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
