CVE-2026-83306

CVE-2026-83306 is a high-severity (CVSS 3.1: 8.8) vulnerability in the Resource Catalog Services component of Oracle JDeveloper, part of Oracle Fusion Middleware. It is easily exploitable by an attacker who already holds low-privileged credentials and has network access to the JDeveloper HTTP interface, requiring no user interaction. Successful exploitation allows the attacker to fully take over the Oracle JDeveloper installation, with high impact on confidentiality, integrity, and availability. Affected supported versions are 12.2.1.4.0 and 14.1.2.0.0. There is no known public proof of concept, the flaw is not on the CISA KEV list, and no in-the-wild exploitation has been reported.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83306 to all Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 installations. Restrict HTTP access to JDeveloper and its Resource Catalog Services endpoints to trusted internal networks and enforce least-privilege accounts. Review logs for anomalous activity by low-privileged users against catalog services that could indicate exploitation attempts.