What is the CVSS score of CVE-2026-46771?

CVE-2026-46771 has a CVSS 3.1 base score of 4.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Oracle ADF CVE-2026-46771

EUVD-2026-37460 MEDIUM

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Java Oracle Oracle Application Development Framework Adf

4.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.1 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.1 MEDIUM

Vendor vector confirmed: local infrastructure access and high existing privileges required; only confidentiality impacted with no integrity or availability effect.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 00:28 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: Java Business Objects). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Application Development Framework (ADF) executes to compromise Oracle Application Development Framework (ADF). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Application Development Framework (ADF) accessible data. CVSS 3.1 Base Score 4.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Local confidentiality compromise in Oracle Application Development Framework (ADF) versions 12.2.1.4.0 and 14.1.2.0.0 exposes all ADF-accessible data to a high-privileged local attacker who can exploit the Java Business Objects component. The vulnerability requires physical or logical access to the infrastructure host and a high-complexity attack path, substantially limiting realistic threat surface. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Oracle addressed this issue in the June 2026 Critical Security Patch Update.

Technical ContextAI

Oracle Application Development Framework (ADF) is a Java EE-based enterprise application development platform, part of Oracle Fusion Middleware. The affected component is Java Business Objects - the data-binding and business service layer that mediates between ADF UI components and backend data sources. The CPE string (cpe:2.3:a:oracle_corporation:oracle_application_development_framework_(adf)) confirms the vulnerability resides in Oracle's proprietary ADF runtime stack rather than a third-party library. The CWE classification is not provided by Oracle, which is consistent with Oracle's general CPU advisory practice of omitting detailed root-cause taxonomy. The 'Authentication Bypass' tag supplied in the intelligence feed is contradicted by the CVSS vector (PR:H), suggesting either that the bypass occurs within a session already holding high privileges - such as bypassing object-level authorization checks rather than bypassing the authentication gate - or that the tag reflects a broader category label rather than a precise exploit primitive. The CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N vector indicates the flaw is exercisable only by an attacker who has already obtained local OS-level access and high application privileges, placing this firmly in a post-compromise or insider-threat model.

RemediationAI

Apply the Oracle Critical Security Patch Update (CPU) for June 2026, which addresses CVE-2026-46771 for ADF versions 12.2.1.4.0 and 14.1.2.0.0. The advisory is available at https://www.oracle.com/security-alerts/cspujun2026.html. An exact patched release version was not independently specified in the advisory data beyond the CPU itself, so administrators should consult Oracle My Oracle Support (MOS) for the precise patch bundle applicable to their ADF and Fusion Middleware versions. Until patching is complete, compensating controls should focus on restricting local OS access to the host running ADF - enforce strong role-based access controls on infrastructure accounts, limit high-privilege ADF application roles to the minimum set of users, enable detailed audit logging of ADF Business Objects queries to detect anomalous data access patterns, and review whether network-level segmentation can reduce the population of users with valid host logon access. These controls do not eliminate the vulnerability but materially reduce the realistic attacker population given the AV:L/PR:H constraint.