CVE-2026-83067: Oracle JDeveloper ADF DOS Vulnerability

CVE-2026-83067 Overview

CVE-2026-83067 affects Oracle JDeveloper, a component of Oracle Fusion Middleware. The vulnerability resides in the Application Development Framework (ADF) Shared Components. Supported versions 12.2.1.4.0 and 14.1.2.0.0 are affected. A low-privileged attacker with network access via HTTP can exploit this issue to compromise Oracle JDeveloper. Successful exploitation allows unauthorized creation, deletion, or modification of critical data accessible to Oracle JDeveloper. The flaw also enables an attacker to cause a hang or repeatable crash, resulting in a complete denial of service. Oracle addressed the issue in the Oracle Security Alert CSPUSEP2026. The vulnerability is categorized under [CWE-284] Improper Access Control.

Critical Impact
A network-accessible, low-privileged attacker can modify or destroy JDeveloper data and cause a full denial-of-service condition without user interaction.

Affected Products

Oracle JDeveloper 12.2.1.4.0
Oracle JDeveloper 14.1.2.0.0
Oracle Fusion Middleware — ADF Shared Components

Discovery Timeline

2026-09-15 - CVE-2026-83067 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83067

Vulnerability Analysis

The vulnerability exists within the ADF Shared Components of Oracle JDeveloper. ADF Shared Components provide reusable services consumed by ADF-based applications during design and runtime. Improper access control in this component allows an authenticated but low-privileged attacker to perform actions beyond their assigned scope. The attacker reaches the vulnerable functionality over HTTP without any user interaction. Once exploited, the attacker can create, delete, or modify data accessible to Oracle JDeveloper, and can trigger a hang or repeatable crash of the application. The confidentiality of data is not affected; the risk centers on integrity and availability of JDeveloper resources.

Root Cause

The root cause is improper access control, tracked as [CWE-284], within the ADF Shared Components module. Authorization checks fail to properly restrict the operations available to low-privileged principals over HTTP interfaces. This gap allows privileged operations affecting JDeveloper-accessible data to run outside their intended trust boundary.

Attack Vector

Exploitation is network-based. An attacker with valid low-privilege credentials issues crafted HTTP requests to the exposed ADF Shared Components interfaces. No user interaction is required, attack complexity is low, and the scope remains unchanged. Successful requests write, delete, or corrupt data reachable by Oracle JDeveloper, or drive the service into a crash loop that produces a complete denial of service.

No public proof-of-concept exploit is currently listed for this CVE. Refer to the Oracle Security Alert CSPUSEP2026 for vendor-supplied technical context.

Detection Methods for CVE-2026-83067

Indicators of Compromise

Unexpected HTTP requests to ADF Shared Components endpoints originating from low-privileged accounts.
Unauthorized creation, modification, or deletion events in Oracle JDeveloper-managed artifacts or workspaces.
Repeated JDeveloper process crashes, hangs, or restart events without a clear operational cause.
Authentication events from accounts accessing ADF interfaces outside their normal usage patterns.

Detection Strategies

Correlate HTTP access logs on JDeveloper hosts with user privilege levels to identify low-privileged principals reaching ADF endpoints.
Monitor application logs for 500-class errors, unhandled exceptions, and abnormal termination signatures tied to ADF Shared Components.
Baseline normal JDeveloper API usage per account and alert on deviations in request volume, method, or target path.
Track integrity of critical JDeveloper data stores using file integrity monitoring and database audit trails.

Monitoring Recommendations

Enable verbose HTTP request logging on JDeveloper front-ends and forward logs to a centralized analytics pipeline.
Route JDeveloper application, access, and authentication logs into a SIEM for cross-source correlation and long-term retention.
Configure alerting on repeated crash or restart events for JDeveloper services within short time windows.
Review Oracle Fusion Middleware audit records for unexpected privileged operations invoked by non-administrative accounts.

How to Mitigate CVE-2026-83067

Immediate Actions Required

Apply the fixes referenced in Oracle Security Alert CSPUSEP2026 to all Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 installations.
Inventory every JDeveloper deployment, including developer workstations and shared build servers, to ensure complete patch coverage.
Restrict network exposure of JDeveloper HTTP interfaces to trusted management networks only.
Audit accounts with access to JDeveloper and remove or downgrade unused low-privilege accounts.

Patch Information

Oracle has released patches through the Oracle Security Alert CSPUSEP2026. Administrators should apply the patches corresponding to the deployed JDeveloper version and validate that the ADF Shared Components module reports the updated build after installation.

Workarounds

Place JDeveloper behind a reverse proxy or web application firewall that enforces authentication and rate limiting on ADF endpoints.
Block external HTTP access to JDeveloper hosts using network firewall or host-based rules until patching is complete.
Enforce least-privilege role assignments and remove standing privileges from accounts that do not require ADF Shared Components access.
Increase logging verbosity and monitoring frequency on JDeveloper systems while remediation is in progress.

bash

# Configuration example: restrict JDeveloper HTTP access to a management subnet
# Replace 10.10.0.0/24 with your trusted administrative network
iptables -A INPUT -p tcp --dport 7101 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7101 -j DROP