Oracle ADF EUVD-2026-37459

Exploitation requires a victim user to interact with attacker-controlled content, such as clicking a crafted HTTP link or visiting a page that triggers a cross-origin request to the ADF application (UI:R mandatory condition). The attacker requires no authentication (PR:N confirmed by CVSS vector) and only standard network access to the ADF application over HTTP. The vulnerability resides specifically in the Security Framework component of ADF, meaning deployments that expose ADF web interfaces to untrusted networks - particularly internet-facing portals - face higher risk. What limits exploitation: the mandatory human interaction step (UI:R) means automated, wormable exploitation is not feasible; the attacker must successfully social-engineer a victim. Impact is bounded to partial confidentiality and integrity (C:L/I:L) on ADF-accessible data, with no availability impact (A:N). Deployments where ADF is strictly internal with no external link-delivery vector have substantially reduced realistic risk despite the low attack complexity.

The CVSS 3.1 base score of 6.1 (Medium) reflects a network-exploitable, low-complexity flaw requiring no authentication, but tempered by mandatory human interaction (UI:R), which significantly reduces opportunistic exploitability. The scope change (S:C) elevates concern for organizations where ADF is tightly integrated with other Fusion Middleware products, as lateral impact is possible. EPSS data is not available in the provided intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, and no POC or active exploitation evidence has been identified. The 'Authentication Bypass' tag suggests the Security Framework itself may be circumvented, which could amplify the downstream scope-change impact beyond what the C:L/I:L metrics alone imply - verify with Oracle's advisory whether full authentication bypass is achievable or whether this tag is a broad categorization. Overall, this is a real but not immediately critical priority; organizations with internet-exposed ADF applications serving authenticated users should prioritize patching to prevent phishing-assisted exploitation. Purely internal ADF deployments with user-awareness controls face lower realistic risk.

An attacker crafts a malicious HTTP URL targeting an Oracle ADF application's Security Framework endpoint and distributes it via phishing email or a compromised third-party site. A logged-in or unauthenticated victim user clicks the link, causing their browser to execute the attacker's payload within the ADF application context, resulting in the attacker reading a subset of the user's ADF-accessible data and performing unauthorized data modifications - potentially extending to additional integrated Fusion Middleware components due to the scope change. No public POC has been identified at time of analysis.