This vulnerability affects Oracle Application Development Framework (ADF) component ADF Faces in versions 12.2.1.4.0 and 14.1.2.0.0. It enables an attacker with low privileges and logon access to the infrastructure to compromise ADF, potentially leading to complete takeover of the framework. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability (7.8 base score). Oracle has addressed this vulnerability in its April 2026 Critical Patch Update, which includes security patches for Fusion Middleware products including ADF.

Successful exploitation can lead to full compromise of Oracle Application Development Framework (ADF), affecting confidentiality, integrity, and availability of the affected system. This could allow an attacker to take over the ADF environment, potentially impacting applications relying on this framework.

Oracle has released security patches for this vulnerability as part of the April 2026 Critical Patch Update for Fusion Middleware products. Customers should promptly apply the April 2026 CPU to affected Oracle ADF versions (12.2.1.4.0 and 14.1.2.0.0) to remediate this vulnerability. Oracle strongly recommends staying on actively supported versions and applying Critical Patch Updates without delay. Patch status is confirmed by the vendor advisory at https://www.oracle.com/security-alerts/cpuapr2026.html.