EUVD-2026-24451
GHSA-gcgv-7762-j94g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local account on ADF host
-
DeliveryAuthenticate and access ADF Faces
-
ExploitAbuse improper access control
-
ExecutionEscalate to ADF takeover
-
ImpactRead/modify data, disrupt availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to (1) have local logon access to the infrastructure/host where Oracle ADF executes (CVSS AV:L - not exploitable over the network) and (2) already possess a low-privileged authenticated account on that system (PR:L). No user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors that reduce realistic risk: the mandatory local access and pre-existing authentication mean a remote, unauthenticated attacker cannot trigger this directly; only supported versions 12.2.1.4.0 and 14.1.2.0.0 are stated as affected. It is NOT a remote unauthenticated flaw despite the 'Authentication Bypass' tag. |
| Impact | Signals are mixed but converge on lower real-world urgency despite the 7.8 "High" score. The CVSS vector (AV:L/AC:L/PR:L/UI:N, S:U, C:H/I:H/A:H) shows the total-impact rating is driven by full CIA loss, but exploitation requires LOCAL access and an existing low-privileged account - this is not a remote pre-auth issue. EPSS is essentially zero (0.01%, 2nd percentile) and CISA SSVC reports Exploitation: none and Automatable: no, while acknowledging Technical Impact: total. No POC and no KEV listing exist. In short, high technical impact but a meaningful access barrier (local + authenticated) and no evidence of exploitation make this a patch-in-normal-cycle item rather than an emergency. Note a tagging tension worth verifying with Oracle: the tag says "Authentication Bypass" yet CVSS scores PR:L (authentication required) and CWE is 284 (improper access control) - treat "authentication bypass" as a possible privilege/access-control escalation, not anonymous bypass, until the Oracle advisory clarifies. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged account with local logon to the Oracle ADF host abuses the ADF Faces access-control weakness to escalate to full control of the ADF instance, reading or altering application data and disrupting availability. No public exploit code is available, and the attack presumes the attacker has first obtained an authenticated local foothold (e.g., via a compromised low-privilege account). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Full compromise of Oracle Application Development Framework (ADF Faces component) is possible by an authenticated low-privileged user with local logon access to the host where ADF executes, affecting Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0. The improper access control weakness (CWE-284) yields complete confidentiality, integrity, and availability loss ("takeover") with a CVSS 3.1 base score of 7.8. No public exploit identified at time of analysis; the EPSS probability is negligible at 0.01% (2nd percentile) and CISA SSVC records exploitation as none.
RemediationAI
Apply the patch delivered in the Oracle Critical Patch Update of April 2026 for the affected ADF versions (12.2.1.4.0 and 14.1.2.0.0); Patch available per vendor advisory at https://www.oracle.com/security-alerts/cpuapr2026.html - Oracle CPUs are cumulative, so apply the full CPU rather than a single hotfix. Because exploitation requires local logon by a low-privileged account, compensating controls until patching include restricting and auditing interactive/local logon rights on the middleware hosts, enforcing least-privilege on application and OS accounts, and segmenting the ADF servers so only trusted operators can authenticate to them; the trade-off is added operational friction for legitimate administrators. Do not rely on network-layer controls alone, since the attack vector is local rather than remote.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle ADF is a Java EE-based application framework within Oracle Fusion Middleware used to build enterprise web applications; the affected element is ADF Faces, its JSF-based rich UI component library. The CPE confirms the affected product as cpe:2.3:a:oracle_corporation:oracle_application_development_framework_(adf). The root cause is classified as CWE-284 (Improper Access Control), meaning the framework fails to properly enforce restrictions on actions or resources; the vendor/tag characterization of "Authentication Bypass" suggests the access-control failure may let a low-privileged principal reach functionality or data it should not, though the CVSS PR:L metric indicates some authenticated foothold is still required rather than fully anonymous access.
Know when Oracle Application Development Framework Adf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description states local logon and low-privileged access required (AV:L, PR:L) with easy exploitation (AC:L) and full takeover, giving C:H/I:H/A:H and unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Development Framework (ADF) executes to compromise Oracle Application Development Framework (ADF). Successful attacks of this vulnerability can result in takeover of Oracle Application Development Framework (ADF). CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 contain an access control vulnerability enabling authenticated users with local system access to achieve complete system compromise, including data exfiltration and operational disruption. Attack success requires both valid user credentials and direct local system logon, concentrating risk to insider threats and advanced attackers with prior network presence. Exploitation probability is minimal (EPSS 0.01%), providing operational window to implement access controls and monitoring before patches arrive.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict local system logon access via OS and network controls, limiting to essential administrative personnel with mandatory logging; (2) Implement privilege access management (PAM) solutions requiring approval, session recording, and audit trails for all privileged account usage; (3) Enable comprehensive audit logging and alerting for privilege escalation attempts and ADF component configuration changes; (4) Deploy network segmentation to isolate affected Fusion Middleware systems from standard user access paths; (5) Disable ADF Faces components if business requirements permit; (6) Establish expedited patch application workflow for when vendor updates become available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
Privileged takeover of Oracle Application Development Framework (ADF) is possible in Fusion Middleware versions 12.2.1.4
Cross-site scripting or authentication bypass in Oracle Application Development Framework (ADF) Security Framework compo
Oracle Application Development Framework (ADF) versions 12.2.1.4.0 and 14.1.2.0.0 expose a local privilege-abuse vulnera
Local confidentiality compromise in Oracle Application Development Framework (ADF) versions 12.2.1.4.0 and 14.1.2.0.0 ex
Exploit-DB