This vulnerability affects Oracle Application Development Framework (ADF) in versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable flaw that permits a high privileged attacker with network access over HTTP to compromise the ADF component, potentially resulting in complete takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes 245 security patches across multiple products. Oracle strongly recommends applying these patches promptly to mitigate the risk. Until patches are applied, risk reduction may be possible by blocking required network protocols or restricting privileges, though these may impact functionality.

Successful exploitation can lead to full compromise of Oracle Application Development Framework (ADF), affecting confidentiality, integrity, and availability of the affected system. This could allow an attacker with high privileges and network access via HTTP to take over the ADF environment.

Oracle has released security patches addressing this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches without delay. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation and by removing unnecessary privileges from users. However, these mitigations may disrupt application functionality. Oracle recommends remaining on actively supported versions and promptly applying all security updates. Patch status is confirmed by the vendor advisory.