CVE-2026-60349 Overview
CVE-2026-60349 affects the Java Business Objects component of Oracle JDeveloper, part of Oracle Fusion Middleware. The vulnerability impacts supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can exploit the flaw, though successful exploitation requires overcoming high attack complexity. Successful attacks result in unauthorized access to all Oracle JDeveloper accessible data and can cause a partial denial of service. Oracle disclosed the issue in the July 2026 Critical Patch Update.
Critical Impact
Authenticated attackers on the network can read all data accessible to Oracle JDeveloper and degrade service availability, exposing sensitive development artifacts and project data.
Affected Products
- Oracle JDeveloper 12.2.1.4.0
- Oracle JDeveloper 14.1.2.0.0
- Oracle Fusion Middleware — Java Business Objects component
Discovery Timeline
- 2026-07-21 - CVE-2026-60349 published to NVD
- 2026-07-23 - Last updated in NVD database
- July 2026 - Oracle publishes fix in the Oracle Critical Patch Update Advisory - July 2026
Technical Details for CVE-2026-60349
Vulnerability Analysis
The flaw resides in the Java Business Objects component of Oracle JDeveloper. Oracle categorizes it as difficult to exploit, requiring specific conditions beyond the attacker's control. The vulnerability primarily impacts confidentiality, with a secondary effect on availability. Integrity is not affected. An authenticated attacker holding low-level privileges can send crafted HTTP requests to the affected JDeveloper instance. On success, the attacker gains unauthorized read access to all data reachable by JDeveloper and can trigger a partial denial of service. No user interaction is required, and the scope remains unchanged, meaning the impact is confined to the vulnerable component.
The EPSS score is 0.294% with a percentile of 21.489, indicating low near-term exploitation likelihood. No public proof-of-concept exploit code has been observed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Root Cause
Oracle has not published a detailed root-cause analysis. The affected component handles Java Business Objects processing within JDeveloper. Consult the Oracle Critical Patch Update Advisory - July 2026 for vendor-provided technical context.
Attack Vector
The attack originates over the network via HTTP. The attacker must already possess low-privilege authenticated access to the JDeveloper environment. The high attack complexity indicates the adversary must satisfy conditions such as timing, configuration state, or specific request sequencing to trigger the flaw. Once triggered, the attacker can enumerate and exfiltrate data accessible to JDeveloper and disrupt component availability.
No verified exploit code has been published. Refer to the vendor advisory for authoritative technical details.
Detection Methods for CVE-2026-60349
Indicators of Compromise
- Anomalous HTTP requests directed at JDeveloper Java Business Objects endpoints originating from low-privilege authenticated sessions.
- Unexpected read access patterns against development project data, source repositories, and configuration files reachable by JDeveloper.
- Intermittent unavailability or degraded response times of the JDeveloper service consistent with partial denial of service.
Detection Strategies
- Inspect HTTP access logs for repeated or malformed requests to Java Business Objects handlers within JDeveloper.
- Correlate authenticated session activity with volume of data reads to identify accounts exceeding baseline behavior.
- Alert on process-level anomalies such as unusual CPU spikes or thread exhaustion within the JDeveloper Java Virtual Machine (JVM).
Monitoring Recommendations
- Centralize JDeveloper and Fusion Middleware logs into a SIEM for correlation with authentication telemetry.
- Track outbound data volumes from developer workstations and JDeveloper hosts to detect exfiltration.
- Maintain audit trails of low-privileged accounts with HTTP access to JDeveloper and review changes to their permissions.
How to Mitigate CVE-2026-60349
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to JDeveloper 12.2.1.4.0 and 14.1.2.0.0 installations.
- Restrict network access to JDeveloper services to trusted management networks and required user segments only.
- Review and reduce the number of accounts with authenticated access to JDeveloper, enforcing least privilege.
Patch Information
Oracle addressed CVE-2026-60349 in the July 2026 Critical Patch Update. Administrators should download and install the fixes referenced in the Oracle Critical Patch Update Advisory - July 2026. Oracle recommends applying Critical Patch Update fixes without delay, as the vendor does not test unpatched configurations for security.
Workarounds
- Place JDeveloper behind an authenticated reverse proxy or VPN to reduce HTTP exposure.
- Enforce network segmentation isolating JDeveloper hosts from general user networks until patching completes.
- Increase monitoring of JDeveloper access logs and disable inactive low-privilege accounts to shrink the attack surface.
# Example: restrict HTTP access to JDeveloper to a management subnet using iptables
iptables -A INPUT -p tcp --dport 7101 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7101 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
