Oracle ADF CVE-2026-46771

Exploitation requires: (1) local logon access to the operating system of the infrastructure host where Oracle ADF executes - remote network exploitation is not possible given AV:L; (2) high application privileges within ADF, indicated by PR:H - the attacker must already hold a high-privilege account or role within the ADF environment; (3) high attack complexity (AC:H) - Oracle classifies this as 'difficult to exploit,' implying specific conditions, race conditions, or non-default state beyond mere access. Exploitation is limited by: the requirement for local infrastructure access eliminating external threat actors without prior foothold; the high privilege prerequisite eliminating unprivileged users; the difficulty rating suggesting reliable exploitation is non-trivial even for a qualifying attacker; and scope unchanged (S:U) meaning no lateral pivot to other system components is enabled by this flaw alone. The 'Authentication Bypass' tag in source intelligence should NOT be interpreted as enabling unauthenticated access - it conflicts directly with PR:H and may describe a sub-authorization bypass within an already-authenticated high-privilege session.

The compound of restrictive CVSS metrics - local attack vector (AV:L), high complexity (AC:H), high privileges required (PR:H) - places this vulnerability in a low operational risk tier despite the high confidentiality impact (C:H). EPSS data was not provided in the intelligence feed, so exploitation probability cannot be quantified; however, the difficult-to-exploit classification, absence of a CISA KEV listing, and absence of public POC code all corroborate a low near-term exploitation risk. The 'Authentication Bypass' tag in the source intelligence appears inconsistent with PR:H - security teams should not equate this with an unauthenticated bypass. The realistic threat model is a malicious insider or a post-breach lateral mover who has already achieved high-privilege local access to the Fusion Middleware host and seeks to exfiltrate data accessible through ADF business service queries. Organizations running ADF in environments where the principle of least privilege is enforced and infrastructure access is tightly controlled face minimal incremental risk. The high confidentiality impact (C:H) is notable for regulated environments processing sensitive data through ADF, where even insider-level data exfiltration carries significant compliance consequences.

An attacker who has already compromised a privileged OS account on the Fusion Middleware host - whether through credential theft, privilege escalation from a lower-privilege account, or insider access - leverages access to the Java Business Objects component to exfiltrate data beyond their authorized scope. The high attack complexity (AC:H) suggests a non-trivial exploitation path, possibly requiring specific timing, configuration state, or knowledge of internal ADF object structures. No public POC exists at time of analysis, so the precise exploitation technique remains undisclosed.