CVE-2026-73961

CVE-2026-73961 is a critical vulnerability (CVSS 3.1 base score 9.8) in the ADF Faces component of Oracle JDeveloper, part of Oracle Fusion Middleware. The flaw is easily exploitable by an unauthenticated attacker who has network access via HTTP, requiring no privileges and no user interaction. A successful attack can result in complete takeover of the Oracle JDeveloper installation, with high impact on confidentiality, integrity, and availability. Affected supported versions are 12.2.1.4.0 and 14.1.2.0.0. No public proof-of-concept is known, the issue is not on the CISA Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-73961 to all JDeveloper 12.2.1.4.0 and 14.1.2.0.0 installations as soon as it is available. Restrict HTTP network access to JDeveloper and associated development servers so they are reachable only from trusted internal networks. Audit those systems for signs of unauthenticated HTTP access or unexpected configuration changes until patched.