{ "cve": "CVE-2026-83424", "enrichment": { "affected": [ { "configurations": [ { "platform": null, "status": "affected", "versions": { "scheme": "generic", "value": "12.2.1.4.0" } }, { "platform": null, "status": "affected", "versions": { "scheme": "generic", "value": "14.1.2.0.0" } } ], "enrichment": { "confidence": 95.0, "confidence_source": "inferred", "scores": [ { "score": 95.0, "source": "inferred" }, { "score": 100.0, "source": "matching" } ] }, "original": { "product": "Oracle JDeveloper", "source": "cna", "vendor": "Oracle Corporation" }, "product": "jdeveloper", "vendor": "oracle" } ], "created": "2026-09-16T06:30:11.144441+00:00", "title": "Unrestricted HTTP Access Exposes Sensitive Data in Oracle JDeveloper", "updated": "2026-09-22T20:30:08.081247+00:00", "vendors": [ "oracle", "oracle$PRODUCT$jdeveloper" ] }, "epss": { "score": 0.00316 }, "mitre": { "cpes": [ "cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdeveloper:14.1.2.0.0:*:*:*:*:*:*:*" ], "created": "2026-09-15T20:05:31.563000+00:00", "description": "Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle JDeveloper). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).", "metrics": { "cvssV2_0": {}, "cvssV3_0": {}, "cvssV3_1": { "score": 7.5, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, "cvssV4_0": {} }, "mitre_repo_path": "cves/2026/83xxx/CVE-2026-83424.json", "references": [ "https://www.oracle.com/security-alerts/cspusep2026.html" ], "title": null, "updated": "2026-09-22T14:27:42.205000+00:00", "vendors": [ "oracle", "oracle$PRODUCT$jdeveloper" ], "weaknesses": [] }, "nvd": { "cpes": [], "created": "2026-09-15T20:18:51.020000+00:00", "description": "Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle JDeveloper). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).", "metrics": { "cvssV2_0": {}, "cvssV3_0": {}, "cvssV3_1": { "score": 7.5, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, "cvssV4_0": {} }, "nvd_repo_path": "2026/CVE-2026-83424.json", "references": [ "https://www.oracle.com/security-alerts/cspusep2026.html" ], "title": null, "updated": "2026-09-22T15:17:18.310000+00:00", "vendors": [], "weaknesses": [ "CWE-200" ] }, "opencve": { "changes": [ { "created": "2026-09-15T20:15:00+00:00", "data": [ { "details": { "new": "Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle JDeveloper). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).", "old": null }, "type": "description" }, { "details": [ "oracle", "oracle$PRODUCT$jdeveloper" ], "type": "first_time" }, { "details": { "added": [ "cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdeveloper:14.1.2.0.0:*:*:*:*:*:*:*" ], "removed": [] }, "type": "cpes" }, { "details": { "added": [ "oracle", "oracle$PRODUCT$jdeveloper" ], "removed": [] }, "type": "vendors" }, { "details": { "added": [ "https://www.oracle.com/security-alerts/cspusep2026.html" ], "removed": [] }, "type": "references" }, { "details": { "added": { "cvssV3_1": { "score": 7.5, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } }, "removed": {}, "updated": {} }, "type": "metrics" } ], "id": "8a2cedbe-02a5-4675-8a2f-4af4572fb278" }, { "created": "2026-09-16T20:30:00+00:00", "data": [ { "details": { "new": "Unauthenticated Remote Data Access via HTTP in Oracle JDeveloper", "old": null }, "type": "title" }, { "details": { "added": [ "CWE-284", "CWE-287" ], "removed": [] }, "type": "weaknesses" } ], "id": "13241e11-9a65-4f84-aaaf-ed7927ad8c97" }, { "created": "2026-09-18T21:30:00+00:00", "data": [ { "details": { "new": null, "old": "Unauthenticated Remote Data Access via HTTP in Oracle JDeveloper" }, "type": "title" }, { "details": { "added": [], "removed": [ "CWE-284", "CWE-287" ] }, "type": "weaknesses" } ], "id": "b26ecac8-3fbf-4120-b5d0-67df8af90d7a" }, { "created": "2026-09-20T08:00:00+00:00", "data": [ { "details": { "new": "Unauthenticated HTTP Access Bypass in Oracle JDeveloper", "old": null }, "type": "title" }, { "details": { "added": [ "CWE-287" ], "removed": [] }, "type": "weaknesses" } ], "id": "7b5751d7-56e7-40f9-b285-0e62703ce557" }, { "created": "2026-09-22T15:30:00+00:00", "data": [ { "details": { "added": [ "CWE-200" ], "removed": [] }, "type": "weaknesses" } ], "id": "61fe35dc-06c6-4598-88b0-885dfede2cce" }, { "created": "2026-09-22T18:15:00+00:00", "data": [ { "details": { "new": null, "old": "Unauthenticated HTTP Access Bypass in Oracle JDeveloper" }, "type": "title" }, { "details": { "added": [], "removed": [ "CWE-287" ] }, "type": "weaknesses" } ], "id": "d8328670-074d-4c41-9c19-92d9998422f8" }, { "created": "2026-09-22T20:45:00+00:00", "data": [ { "details": { "new": "Unrestricted HTTP Access Exposes Sensitive Data in Oracle JDeveloper", "old": null }, "type": "title" } ], "id": "934fe3af-2c27-4894-a0f8-e3ed49882fef" }, { "created": "2026-09-23T15:30:00+00:00", "data": [ { "details": { "added": { "ssvc": { "options": { "Automatable": "yes", "Exploitation": "none", "Technical Impact": "partial" }, "version": "2.0.3" } }, "removed": {}, "updated": {} }, "type": "metrics" } ], "id": "5cc45111-d566-46af-9689-c331f2e53ae6" } ], "cpes": { "data": [ "cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:jdeveloper:14.1.2.0.0:*:*:*:*:*:*:*" ], "providers": [ "mitre" ] }, "created": { "data": "2026-09-15T20:05:31.563000+00:00", "provider": "mitre" }, "description": { "data": "Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle JDeveloper). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).", "provider": "mitre" }, "metrics": { "cvssV2_0": { "data": {}, "provider": null }, "cvssV3_0": { "data": {}, "provider": null }, "cvssV3_1": { "data": { "score": 7.5, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, "provider": "mitre" }, "cvssV4_0": { "data": {}, "provider": null }, "epss": { "data": { "score": 0.00316 }, "provider": "first" }, "kev": { "data": {}, "provider": null }, "ssvc": { "data": { "options": { "Automatable": "yes", "Exploitation": "none", "Technical Impact": "partial" }, "version": "2.0.3" }, "provider": "vulnrichment" }, "threat_severity": { "data": null, "provider": null } }, "references": { "data": [ "https://www.oracle.com/security-alerts/cspusep2026.html" ], "providers": [ "mitre", "nvd" ] }, "title": { "data": "Unrestricted HTTP Access Exposes Sensitive Data in Oracle JDeveloper", "provider": "enrichment" }, "updated": { "data": "2026-09-22T20:30:08.081247+00:00", "provider": "enrichment" }, "vendors": { "data": [ "oracle", "oracle$PRODUCT$jdeveloper" ], "providers": [ "mitre", "enrichment" ] }, "weaknesses": { "data": [ "CWE-200" ], "providers": [ "nvd", "vulnrichment" ] } }, "vulnrichment": { "cpes": [], "created": "2026-09-15T20:05:31.563000+00:00", "description": "Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle JDeveloper). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).", "metrics": { "cvssV2_0": {}, "cvssV3_0": {}, "cvssV3_1": {}, "cvssV4_0": {}, "kev": {}, "ssvc": { "options": { "Automatable": "yes", "Exploitation": "none", "Technical Impact": "partial" }, "version": "2.0.3" } }, "references": [], "title": null, "updated": "2026-09-22T14:26:11.920000+00:00", "vendors": [], "vulnrichment_repo_path": "2026/83xxx/CVE-2026-83424.json", "weaknesses": [ "CWE-200" ] } }