CVE-2026-60352 Overview
CVE-2026-60352 is an information disclosure vulnerability in Oracle JDeveloper, part of Oracle Fusion Middleware. The flaw resides in the Application Development Framework (ADF) Faces component. Affected versions include Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0.
An unauthenticated remote attacker can exploit the vulnerability over HTTP to gain unauthorized read access to a subset of Oracle JDeveloper data. The attack complexity is high, which reduces the practical exploitability. Oracle addressed the issue in the July 2026 Critical Patch Update.
Critical Impact
Successful exploitation grants an unauthenticated network attacker read access to a subset of Oracle JDeveloper accessible data, resulting in confidentiality loss without integrity or availability impact.
Affected Products
- Oracle JDeveloper 12.2.1.4.0
- Oracle JDeveloper 14.1.2.0.0
- Oracle Fusion Middleware (ADF Faces component)
Discovery Timeline
- 2026-07-21 - CVE-2026-60352 published to NVD
- 2026-07-21 - Last updated in NVD database
- July 2026 - Oracle addresses the issue in the Oracle Critical Patch Update Advisory - July 2026
Technical Details for CVE-2026-60352
Vulnerability Analysis
The vulnerability affects the ADF Faces component of Oracle JDeveloper. ADF Faces is a JavaServer Faces (JSF) library that provides rich UI components for building web applications in Oracle Fusion Middleware environments. Weaknesses in this component expose accessible data over HTTP to unauthenticated callers.
The issue is classified as an information disclosure flaw. Exploitation does not require authentication or user interaction, but attackers must satisfy conditions outside their direct control, which increases attack complexity. The impact scope is limited to confidentiality — the vulnerability does not allow modification of data or disruption of service.
The EPSS score is 0.258%, reflecting a low probability of exploitation in the near term. No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Root Cause
Oracle has not published root cause specifics beyond the advisory. The vulnerability originates in how the ADF Faces component in Oracle JDeveloper handles HTTP-accessible resources or requests, permitting an unauthenticated caller to read a subset of application data. Refer to the Oracle Security Alert July 2026 for vendor-supplied context.
Attack Vector
The attack vector is network-based over HTTP. An unauthenticated attacker sends crafted HTTP requests to an Oracle JDeveloper instance exposing the vulnerable ADF Faces component. Successful requests return a limited subset of accessible data to the attacker. No user interaction is required, but the high attack complexity implies specific preconditions must hold in the target environment.
No verified exploitation code is publicly available. Defenders should treat the vulnerability as a data-exposure risk in exposed Oracle JDeveloper deployments and prioritize patching per the July 2026 CPU guidance.
Detection Methods for CVE-2026-60352
Indicators of Compromise
- Unusual HTTP requests targeting ADF Faces endpoints on Oracle JDeveloper hosts from unauthenticated sources.
- Unexpected outbound data transfers or elevated HTTP response sizes from JDeveloper instances.
- Access log entries showing anonymous requests to ADF Faces resource URLs (for example, paths containing /adf/ or /afr/).
Detection Strategies
- Monitor web server and reverse proxy logs fronting Oracle JDeveloper for anomalous request patterns targeting ADF Faces components.
- Deploy web application firewall (WAF) rules that flag or block anonymous requests to sensitive ADF Faces resource paths.
- Correlate HTTP access telemetry with authentication events to identify unauthenticated data retrieval attempts.
Monitoring Recommendations
- Enable verbose access logging on Oracle JDeveloper and any front-end HTTP tier.
- Ingest HTTP access logs into a centralized SIEM for correlation and long-term retention.
- Baseline normal ADF Faces request volumes and alert on statistical deviations that could indicate scraping or enumeration.
How to Mitigate CVE-2026-60352
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 deployments.
- Inventory Oracle Fusion Middleware assets and confirm which instances expose ADF Faces components to untrusted networks.
- Restrict network access to Oracle JDeveloper management interfaces to trusted administrative segments only.
Patch Information
Oracle released fixes for CVE-2026-60352 in the July 2026 Critical Patch Update. Consult the Oracle Critical Patch Update Advisory - July 2026 for patch identifiers, applicability, and installation guidance for each affected version.
Workarounds
- Place Oracle JDeveloper behind an authenticating reverse proxy so that unauthenticated HTTP requests cannot reach ADF Faces endpoints.
- Enforce firewall or network ACL restrictions limiting inbound HTTP traffic to known administrator source ranges until the patch is applied.
- Disable or remove exposure of any ADF Faces resources that are not required for the deployment's function.
# Example: restrict inbound HTTP to Oracle JDeveloper to a trusted admin subnet
# Replace 10.0.10.0/24 with your administrative network and eth0 with the target interface
iptables -A INPUT -p tcp --dport 8080 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
