CVE-2026-60622: Oracle JDeveloper Information Disclosure

CVE-2026-60622 Overview

CVE-2026-60622 affects the Security Framework component of Oracle JDeveloper, a product within the Oracle Fusion Middleware suite. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise confidentiality of data accessible through the affected product. Oracle disclosed the issue as part of the July 2026 Critical Patch Update advisory.

Affected supported versions are Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0. The flaw requires no user interaction and no privileges, making it straightforward to exploit remotely against exposed instances.

Critical Impact
Unauthenticated network attackers can retrieve unauthorized data from or gain complete access to all data reachable by Oracle JDeveloper, resulting in high confidentiality impact.

Affected Products

Oracle JDeveloper 12.2.1.4.0
Oracle JDeveloper 14.1.2.0.0
Oracle Fusion Middleware (Security Framework component)

Discovery Timeline

2026-07-21 - CVE-2026-60622 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in NVD
July 2026 - Oracle publishes fix details in the Oracle Security Alert July 2026

Technical Details for CVE-2026-60622

Vulnerability Analysis

The vulnerability resides in the Security Framework component of Oracle JDeveloper. Oracle categorizes the impact as high confidentiality with no integrity or availability impact, indicating that exploitation exposes sensitive data rather than allowing modification or service disruption. Successful exploitation can result in unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data.

The attack surface is exposed over HTTP, so any JDeveloper instance reachable across the network is at risk. Because no authentication or user interaction is required, adversaries can automate discovery and data collection at scale. The EPSS score is 0.398% (32nd percentile), reflecting current predicted exploitation likelihood while patches propagate.

Root Cause

Oracle has not published low-level technical detail beyond identifying the Security Framework component. The class of impact — remote, unauthenticated confidentiality loss reachable via HTTP — is consistent with an information disclosure weakness in the framework's request handling or authorization enforcement path. Refer to the Oracle Security Alert July 2026 for vendor-supplied details.

Attack Vector

An attacker sends crafted HTTP requests to a network-reachable Oracle JDeveloper instance running 12.2.1.4.0 or 14.1.2.0.0. Because privileges and user interaction are not required, exploitation can occur directly from the internet where JDeveloper interfaces are exposed, or from adjacent segments in enterprise deployments. The attacker receives sensitive data from responses without generating authentication events.

No public proof-of-concept exploit is available at the time of publication. Oracle has not reported in-the-wild exploitation, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-60622

Indicators of Compromise

Anomalous unauthenticated HTTP requests targeting Oracle JDeveloper endpoints, especially large or repeated GET requests to Security Framework paths
Outbound data transfers from JDeveloper hosts to unfamiliar external IP addresses
HTTP responses containing configuration data, credentials, or project artifacts returned to unauthenticated sessions

Detection Strategies

Inventory all Oracle JDeveloper installations and confirm versions against 12.2.1.4.0 and 14.1.2.0.0 to scope exposure
Review web server and reverse proxy logs for unauthenticated requests that returned non-empty response bodies from JDeveloper URIs
Correlate HTTP access logs with process telemetry on JDeveloper hosts to identify off-hours or unexpected access patterns

Monitoring Recommendations

Alert on HTTP requests to JDeveloper from IP addresses outside approved developer networks
Monitor for spikes in response sizes and request rates against Security Framework endpoints
Track egress traffic volumes from Oracle Fusion Middleware hosts to identify potential data exfiltration

How to Mitigate CVE-2026-60622

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 deployments
Restrict network access to JDeveloper interfaces so only trusted developer subnets can reach HTTP endpoints
Audit recent HTTP access logs for unauthenticated requests that may indicate prior exploitation attempts

Patch Information

Oracle released the fix as part of the July 2026 Critical Patch Update. Administrators should download and apply the patches referenced in the Oracle Security Alert July 2026 for their specific JDeveloper version. Oracle strongly recommends applying Critical Patch Update fixes without delay.

Workarounds

Place Oracle JDeveloper behind an authenticated reverse proxy or VPN to block unauthenticated HTTP access from untrusted networks
Apply strict firewall ACLs limiting inbound HTTP to specific developer workstation ranges
Disable or isolate any internet-exposed JDeveloper instances until the patch is applied

bash

# Example: restrict inbound HTTP to JDeveloper using iptables
iptables -A INPUT -p tcp --dport 7101 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7101 -j DROP