What is the CVSS score of CVE-2026-35243?

CVE-2026-35243 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Oracle ADF are affected by CVE-2026-35243?

Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 contain an access control vulnerability enabling authenticated users with local system access to achieve complete system compromise,…

How to fix or mitigate CVE-2026-35243?

Within 24 hours: Identify and document all production systems running Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0; audit which personnel have local system access to these servers. Within 7 days: Restrict local logon privileges on ADF systems to essential administrative staff only using operating system access controls; enable comprehensive audit logging for Fusion Middleware and monitor all privilege escalation attempts; implement network segmentation to isolate these systems from general user networks. Within 30 days: Contact Oracle Support to confirm patch release timeline; if patches are not released within 60 days, evaluate and execute migration plans to newer Fusion Middleware versions and deploy privilege access management (PAM) solutions for any retained systems.

Oracle ADF CVE-2026-35243

EUVD-2026-24451 HIGH

Improper Access Control (CWE-284)

2026-04-21 oracle

GHSA-gcgv-7762-j94g

Authentication Bypass Oracle Oracle Application Development Framework Adf Oracle Corporation

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Description states local logon and low-privileged access required (AV:L, PR:L) with easy exploitation (AC:L) and full takeover, giving C:H/I:H/A:H and unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:02 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24451

CVE Published

Apr 21, 2026 - 20:35 nvd

HIGH 7.8

DescriptionCVE.org

Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Development Framework (ADF) executes to compromise Oracle Application Development Framework (ADF). Successful attacks of this vulnerability can result in takeover of Oracle Application Development Framework (ADF). CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Application Development Framework (ADF Faces component) is possible by an authenticated low-privileged user with local logon access to the host where ADF executes, affecting Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0. The improper access control weakness (CWE-284) yields complete confidentiality, integrity, and availability loss ("takeover") with a CVSS 3.1 base score of 7.8. No public exploit identified at time of analysis; the EPSS probability is negligible at 0.01% (2nd percentile) and CISA SSVC records exploitation as none.

Technical ContextAI

Oracle ADF is a Java EE-based application framework within Oracle Fusion Middleware used to build enterprise web applications; the affected element is ADF Faces, its JSF-based rich UI component library. The CPE confirms the affected product as cpe:2.3:a:oracle_corporation:oracle_application_development_framework_(adf). The root cause is classified as CWE-284 (Improper Access Control), meaning the framework fails to properly enforce restrictions on actions or resources; the vendor/tag characterization of "Authentication Bypass" suggests the access-control failure may let a low-privileged principal reach functionality or data it should not, though the CVSS PR:L metric indicates some authenticated foothold is still required rather than fully anonymous access.

RemediationAI

Apply the patch delivered in the Oracle Critical Patch Update of April 2026 for the affected ADF versions (12.2.1.4.0 and 14.1.2.0.0); Patch available per vendor advisory at https://www.oracle.com/security-alerts/cpuapr2026.html - Oracle CPUs are cumulative, so apply the full CPU rather than a single hotfix. Because exploitation requires local logon by a low-privileged account, compensating controls until patching include restricting and auditing interactive/local logon rights on the middleware hosts, enforcing least-privilege on application and OS accounts, and segmenting the ADF servers so only trusted operators can authenticate to them; the trade-off is added operational friction for legitimate administrators. Do not rely on network-layer controls alone, since the attack vector is local rather than remote.