Oracle ADF CVE-2026-46772

Exploitation requires the attacker to have an existing authenticated logon (high-privilege OS or domain account) to the infrastructure host or virtual machine where Oracle ADF executes - this is not a remotely exploitable network-facing flaw. The vulnerable component is specifically ADF Faces within Oracle Fusion Middleware versions 12.2.1.4.0 or 14.1.2.0.0; other ADF component configurations or versions are not confirmed affected. High attack complexity (AC:H) indicates the exploitation path is not straightforward and may depend on a specific runtime state, timing condition, or application configuration. No special end-user interaction is required once the attacker is on the local system. What limits exploitation: the attacker must already hold high local or WebLogic domain privileges (PR:H), the target must be running one of the two named ADF versions, and the high complexity (AC:H) means the attack does not reliably succeed on demand. There is no availability impact, and scope does not change beyond the ADF system boundary (S:U).

The overall real-world risk is LOW-TO-MODERATE despite the High confidentiality impact. The CVSS 3.1 score of 4.7 accurately reflects the severe constraints: AV:L requires the attacker to already have logon access to the server infrastructure; AC:H indicates non-trivial exploitation conditions that do not reliably succeed on first attempt; and PR:H requires the attacker to already hold elevated operating-system or WebLogic-domain privileges. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified. This CVE is NOT in the CISA KEV catalog and no publicly available proof-of-concept exploit has been identified at time of analysis. The 'Authentication Bypass' tag introduces a notable analytical tension: if the attacker already holds PR:H credentials, the bypass likely targets an inner ADF authorization layer (e.g., ADF Security, JAZN policy engine) rather than the initial authentication gate - this is an escalation-of-privilege-within-role scenario. SSVC signals point toward a 'Track' disposition: exploitation requires significant prior access, attack complexity is high, and no active exploitation is confirmed. Organizations running ADF in multi-tenant Fusion Middleware environments or shared WebLogic domains face higher relative risk due to potential cross-tenant data exposure.

An attacker who has already compromised a high-privileged OS or WebLogic domain account on the server hosting Oracle ADF leverages the ADF Faces access control flaw to bypass the application's internal data authorization layer - for example, accessing data scoped to other users or application roles. No public proof-of-concept exploit exists, so this scenario currently requires attacker-developed tooling and high attack complexity, limiting practical exploitation to sophisticated, targeted threat actors with existing foothold on ADF infrastructure.