CVE-2026-83067

CVE-2026-83067 is a flaw in the ADF Shared Components of Oracle JDeveloper (part of Oracle Fusion Middleware), affecting versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by a low-privileged (authenticated) attacker who has network access to the product via HTTP. A successful attack lets the attacker create, delete, or modify critical data — or all data accessible to Oracle JDeveloper — and to hang or repeatedly crash the product, causing a complete denial of service. The CVSS 3.1 base score is 8.1 (high), driven by high integrity and availability impacts (confidentiality is not affected). No public proof of concept is known and the flaw is not on the CISA KEV catalog, so there is no indication of in-the-wild exploitation.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83067 to JDeveloper 12.2.1.4.0 and 14.1.2.0.0 as soon as it is available for your environment. Restrict HTTP/network access to JDeveloper and ADF endpoints so only trusted developers and hosts can reach them, and enforce least-privilege accounts. Review ADF-accessible data and application logs for unauthorized modifications or unexplained crashes/hangs that could indicate attempted exploitation.