What is the CVSS score of EUVD-2026-37458?

EUVD-2026-37458 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle ADF are affected by EUVD-2026-37458?

Oracle Fusion Middleware ADF versions 12.2.1.4.0 and 14.1.2.0.0 contain a high-severity vulnerability allowing privileged users or compromised administrative accounts to achieve complete system…

How to fix or mitigate EUVD-2026-37458?

24 hours: Identify all systems running Oracle Fusion Middleware ADF 12.2.1.4.0 and 14.1.2.0.0; implement network access restrictions to ADF Shared Components limiting HTTP connectivity to administrative users only. 7 days: Deploy enhanced logging and monitoring on ADF Shared Components; conduct privileged access audit to identify and remove unnecessary high-privilege accounts. 30 days: Monitor vendor advisories for patch release and plan immediate deployment; evaluate migration to unaffected ADF versions as interim measure.

Oracle ADF EUVD-2026-37458

| CVE-2026-46769 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Oracle Oracle Application Development Framework Adf Authentication Bypass

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

HTTP-reachable so AV:N, no special conditions AC:L, requires existing high-privileged ADF account so PR:H, no victim action UI:N, full takeover gives C/I/A:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:11 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Shared Components). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Application Development Framework (ADF). Successful attacks of this vulnerability can result in takeover of Oracle Application Development Framework (ADF). CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Privileged takeover of Oracle Application Development Framework (ADF) is possible in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where an attacker with high privileges and HTTP network access to the ADF Shared Components can fully compromise the product. The CVSS 3.1 base score is 7.2 with high impact to confidentiality, integrity, and availability, and Oracle classifies the issue as easily exploitable once authentication is obtained. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Oracle ADF is a Java EE-based development framework used to build enterprise web applications within Oracle Fusion Middleware, and the flaw resides in the ADF Shared Components module which provides common runtime functionality across ADF-built applications. The CPE string cpe:2.3:a:oracle_corporation:oracle_application_development_framework_(adf) confirms the affected product family, while the affected versions span both the long-supported 12.2.1.4.0 release and the newer 14.1.2.0.0 release. No CWE has been assigned by Oracle or NVD, which is typical for Oracle Critical Patch Update entries where root-cause classification is intentionally withheld; the description's reference to a complete takeover via HTTP suggests an authenticated administrative interface or shared component endpoint that fails to enforce proper authorization or input handling.

RemediationAI

Apply the patches distributed in the Oracle Critical Security Patch Update for June 2026 referenced at https://www.oracle.com/security-alerts/cspujun2026.html - patch available per vendor advisory, with exact patched build numbers identified in the CPU matrix for the 12.2.1.4.0 and 14.1.2.0.0 release lines. Until patching is possible, reduce exposure by tightening access controls on any administrative or privileged ADF endpoints (network ACLs, reverse-proxy authentication, and WAF rules in front of Fusion Middleware front-ends), rotate and audit high-privileged ADF/Fusion Middleware accounts to shrink the pool of actors that satisfy the PR:H prerequisite, and enable detailed access logging on ADF Shared Components - the trade-off is that admin workflows may break if ACLs are scoped too narrowly, so coordinate with application owners before tightening.