CVE-2026-83266

CVE-2026-83266 is a high-severity (CVSS 8.2) vulnerability in the Resource Catalog Services component of Oracle JDeveloper, part of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an unauthenticated attacker who has network access to the JDeveloper instance via HTTP, requiring no privileges or user interaction. A successful attack allows the attacker to read critical data or all data accessible to Oracle JDeveloper, and to cause a partial denial of service, though integrity is not impacted. Organizations running the affected JDeveloper releases with HTTP-reachable services are exposed, primarily within internal development environments. No public proof-of-concept exists and the flaw is not on the CISA Known Exploited Vulnerabilities list, so exploitation is not currently known.

What to do: Apply the Oracle Critical Patch Update that remediates this flaw and move off JDeveloper 12.2.1.4.0 and 14.1.2.0.0 to the patched release. Restrict network access to JDeveloper and its Resource Catalog Services HTTP endpoints using firewall rules or an allowlist of developer subnets. Review HTTP access logs on affected hosts for unauthenticated requests to resource catalog service paths as an indicator of attempted exploitation.