CVE-2026-60629: Oracle JDeveloper Auth Bypass Vulnerability

CVE-2026-60629 Overview

CVE-2026-60629 is a vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware, specifically within the Data Visualization Tools component. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can exploit the vulnerability, though exploitation is difficult. Successful attacks cross a trust boundary, resulting in scope change that can impact additional Oracle products beyond JDeveloper itself. Exploitation can yield unauthorized access to all JDeveloper-accessible data and unauthorized update, insert, or delete access to a subset of that data.

Critical Impact
An unauthenticated remote attacker can compromise Oracle JDeveloper over HTTP, causing a scope change that affects additional products with high confidentiality impact and partial integrity impact.

Affected Products

Oracle JDeveloper 12.2.1.4.0
Oracle JDeveloper 14.1.2.0.0
Oracle Fusion Middleware (Data Visualization Tools component)

Discovery Timeline

2026-07-21 - CVE CVE-2026-60629 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update

Technical Details for CVE-2026-60629

Vulnerability Analysis

The vulnerability resides in the Data Visualization Tools component of Oracle JDeveloper, an integrated development environment (IDE) shipped as part of Oracle Fusion Middleware. The issue is reachable over the network via HTTP without authentication, and it produces a scope change. This means an attacker can leverage the flaw in JDeveloper to influence components outside its security authority. Confidentiality impact is high, integrity impact is low, and availability is not affected. The attack complexity is high, indicating that successful exploitation depends on conditions outside the attacker's control, such as specific configurations or timing.

The EPSS score is 0.271% (percentile 19.025), indicating a relatively low probability of observed exploitation activity in the near term.

Root Cause

Oracle has not published a detailed technical root cause analysis. Based on the advisory metadata, the weakness stems from improper handling of untrusted HTTP-borne input within the Data Visualization Tools component, permitting an unauthenticated caller to read sensitive data and perform limited data modifications while breaching the security boundary between JDeveloper and neighboring products.

Attack Vector

Attack traffic is delivered over the network via HTTP. No authentication or user interaction is required. Because the CVSS scope is Changed (S:C), a successful attack against the vulnerable JDeveloper component can affect resources managed by other Oracle Fusion Middleware components sharing the environment. Refer to the Oracle Critical Patch Update advisory for authoritative details.

No public proof-of-concept exploit is available at the time of publication.

Detection Methods for CVE-2026-60629

Indicators of Compromise

Unauthenticated HTTP requests to Oracle JDeveloper Data Visualization Tools endpoints from external or unexpected internal sources.
Anomalous read access patterns against JDeveloper-managed data stores or configuration files.
Unexpected update, insert, or delete operations on JDeveloper-accessible datasets originating from web-facing processes.

Detection Strategies

Inspect web server and application logs on JDeveloper hosts for anomalous requests targeting Data Visualization Tools URIs.
Correlate outbound activity from JDeveloper processes with access events on adjacent Fusion Middleware components to identify scope-change exploitation.
Deploy signatures on web application firewalls (WAF) and intrusion detection systems (IDS) for malformed HTTP payloads targeting 12.2.1.4.0 and 14.1.2.0.0 builds.

Monitoring Recommendations

Enable verbose HTTP access logging on all JDeveloper instances and forward logs to a centralized analytics platform.
Baseline normal request rates and content types for the Data Visualization Tools component, and alert on deviations.
Monitor authentication events and data-plane operations on connected Oracle products for lateral activity following JDeveloper anomalies.

How to Mitigate CVE-2026-60629

Immediate Actions Required

Apply the fixes from the July 2026 Oracle Critical Patch Update to all JDeveloper 12.2.1.4.0 and 14.1.2.0.0 installations.
Inventory all JDeveloper deployments, including developer workstations and shared build servers, to ensure complete patch coverage.
Restrict inbound HTTP access to JDeveloper instances to trusted management networks only.

Patch Information

Oracle addressed CVE-2026-60629 in the July 2026 Critical Patch Update. Administrators should download and apply the relevant patch bundles for Oracle Fusion Middleware from the Oracle Critical Patch Update advisory. Given the scope-change nature of the flaw, prioritize patching in environments where JDeveloper is colocated with other Fusion Middleware components.

Workarounds

Place JDeveloper instances behind an authenticating reverse proxy and block direct external HTTP access until patches are deployed.
Disable or restrict the Data Visualization Tools component where it is not required for business workflows.
Apply network segmentation to isolate JDeveloper hosts from production Fusion Middleware components to limit scope-change impact.

bash

# Example: restrict inbound HTTP access to JDeveloper via host firewall (Linux)
# Allow only the management subnet 10.10.20.0/24 to reach JDeveloper on TCP/7101
iptables -A INPUT -p tcp --dport 7101 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7101 -j DROP