CVE-2026-60350: Oracle JDeveloper Auth Bypass Vulnerability

CVE-2026-60350 Overview

CVE-2026-60350 is a vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware, specifically in the Application Development Framework (ADF) Faces component. Oracle lists versions 12.2.1.4.0 and 14.1.2.0.0 as affected. A low-privileged attacker with local logon access to the infrastructure where Oracle JDeveloper executes can exploit this issue. Successful exploitation can result in unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data. Because the vulnerability produces a scope change, attacks may significantly impact additional products beyond JDeveloper itself.

Critical Impact
A local, low-privileged attacker can access sensitive data across Oracle JDeveloper and, due to scope change, impact additional connected Oracle Fusion Middleware components.

Affected Products

Oracle JDeveloper 12.2.1.4.0
Oracle JDeveloper 14.1.2.0.0
Oracle Fusion Middleware (ADF Faces component)

Discovery Timeline

2026-07-21 - CVE-2026-60350 published to the National Vulnerability Database (NVD)
2026-07-23 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update July 2026

Technical Details for CVE-2026-60350

Vulnerability Analysis

The flaw resides in the ADF Faces component of Oracle JDeveloper. ADF Faces provides the JavaServer Faces (JSF) rendering and component library used by Oracle Fusion Middleware applications. The vulnerability exposes confidentiality-sensitive data handled by JDeveloper, and the attack surface extends beyond JDeveloper itself due to a scope change. According to Oracle, the attack complexity is low and requires only local logon rights with limited privileges. No user interaction is required to trigger the flaw, which increases the risk of automated abuse by any account with shell or session access to the host.

The impact profile is confidentiality-only: the vulnerability does not modify data or degrade availability, but it does expose information handled by the JDeveloper process. EPSS currently rates the exploitation probability at 0.145%, placing this issue in the lower likelihood band for near-term active exploitation.

Root Cause

Oracle has not published a detailed technical root cause. Based on the advisory metadata, the defect is located in the ADF Faces rendering and request-handling path within JDeveloper. The scope change indicates that the vulnerable component operates with authority over resources outside its own security boundary, allowing an attacker to reach data belonging to other components in the Oracle Fusion Middleware stack.

Attack Vector

Exploitation requires local access to the host running Oracle JDeveloper and a low-privileged account. The attacker interacts with the ADF Faces component through the local JDeveloper runtime. Because no user interaction is needed, any account that can execute processes or reach the local JDeveloper interfaces can attempt exploitation. Detailed proof-of-concept code has not been publicly released. Refer to the Oracle Security Alert July 2026 for vendor guidance on the affected code paths.

Detection Methods for CVE-2026-60350

Indicators of Compromise

Unexpected read access to JDeveloper configuration files, project workspaces, or ADF metadata by non-administrative local accounts.
Anomalous local process execution originating from JDeveloper installation directories or ADF Faces libraries.
Local logon events for low-privileged accounts on hosts running JDeveloper 12.2.1.4.0 or 14.1.2.0.0 outside of expected developer activity.

Detection Strategies

Inventory endpoints and servers running Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 and correlate with active local user sessions.
Enable file integrity monitoring on JDeveloper install paths and ADF Faces runtime directories to flag unauthorized reads.
Review authentication logs for interactive or remote-desktop sessions on JDeveloper hosts by accounts that do not normally develop with the product.

Monitoring Recommendations

Forward OS authentication, process, and file access telemetry from JDeveloper hosts to a centralized SIEM or data lake for correlation.
Alert on new local account creation or privilege changes on developer workstations and Fusion Middleware infrastructure.
Track outbound data movement from JDeveloper hosts to detect exfiltration of source code, credentials, or ADF configuration data.

How to Mitigate CVE-2026-60350

Immediate Actions Required

Apply the fixes delivered in the Oracle Critical Patch Update July 2026 to all JDeveloper 12.2.1.4.0 and 14.1.2.0.0 installations.
Restrict interactive logon on hosts running JDeveloper to a minimal set of trusted developer accounts.
Audit and remove unused or dormant local accounts on JDeveloper infrastructure.

Patch Information

Oracle addressed CVE-2026-60350 as part of the July 2026 Critical Patch Update. Administrators should download the appropriate patch bundle for Oracle Fusion Middleware and apply it to every affected JDeveloper installation. Verify patch installation by checking the JDeveloper version banner and Oracle inventory records after deployment.

Workarounds

Limit local access to JDeveloper hosts through group policy, sudoers configuration, or PAM restrictions until patches are applied.
Isolate JDeveloper development environments from production Fusion Middleware systems to reduce the scope-change blast radius.
Enforce least-privilege file system permissions on JDeveloper installation directories and ADF Faces runtime artifacts.

bash

# Example: restrict interactive logon on Linux JDeveloper hosts to a developer group
sudo groupadd jdev-users
sudo usermod -aG jdev-users <developer-account>

# /etc/security/access.conf
# Deny local logon to all except members of jdev-users and root
-:ALL EXCEPT root jdev-users:LOCAL

# Verify installed JDeveloper version after patching
$ORACLE_HOME/jdeveloper/jdev/bin/jdev -version