Oracle ADF CVE-2026-46769

Exploitation requires the attacker to already possess high privileges on the target Oracle ADF deployment (PR:H) and network HTTP reachability to the ADF Shared Components interface; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The vulnerability only affects Oracle ADF 12.2.1.4.0 and 14.1.2.0.0 within Oracle Fusion Middleware, so deployments on other ADF versions or non-ADF Fusion Middleware components are not in scope. The PR:H requirement is the dominant limiting factor - without an existing high-privileged session or credential, the bug cannot be reached directly from the internet.

The CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H produces a base score of 7.2 (High), driven by full C/I/A impact but tempered by the PR:H requirement that the attacker already hold high privileges within the ADF environment. There is no EPSS score, no CISA KEV entry, and no public exploit identified at time of analysis, so real-world exploitation pressure is currently low and aligned with typical Oracle CPU advisories which rarely see immediate weaponization. The principal risk is post-compromise privilege escalation or lateral movement: an attacker who has already obtained high-privileged credentials (insider, compromised admin, or chained from another bug) can pivot to a full ADF takeover. Note a tension in the input - the tags list 'Information Disclosure' but the CVSS vector reflects full C/I/A impact and the description states 'takeover,' so the tag appears to under-represent the true impact and should not be relied on for triage.

An attacker who has already obtained high-privileged credentials on an Oracle Fusion Middleware environment - for example through a phished administrator account or a chained exploit elsewhere in the stack - sends crafted HTTP requests to the ADF Shared Components interface. Because the vector is AC:L and UI:N, the request requires no special timing and no victim interaction, and a successful request results in full takeover of the ADF instance with high impact to confidentiality, integrity, and availability. No public PoC has been published at time of analysis.