CVE-2026-46770 is a vulnerability in the Security Framework component of Oracle Application Development Framework (ADF) affecting versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to compromise the framework by performing unauthorized update, insert, or delete operations and unauthorized read access to some data. Exploitation requires user interaction from a person other than the attacker and can affect other Oracle products due to scope change. The CVSS 3.1 base score is 6.1, reflecting medium severity with low complexity attack vector but requiring user interaction and resulting in partial confidentiality and integrity impact. Oracle’s June 2026 Critical Security Patch Update advisory references this vulnerability among 245 fixes but does not explicitly confirm a dedicated patch for these versions in the provided text. Oracle recommends applying the full Critical Security Patch Update and considering network protocol blocking or privilege reduction as interim mitigations.

Successful exploitation can lead to unauthorized update, insert, or delete operations on Oracle ADF accessible data and unauthorized read access to a subset of that data. This compromises confidentiality and integrity of affected data but does not impact availability. The vulnerability requires network access via HTTP and user interaction from a third party, increasing the attack complexity. The scope of impact may extend beyond Oracle ADF to other Oracle products due to shared components or integrations.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which includes security patches addressing this vulnerability among many others. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges or package access from users. These mitigations may affect application functionality and should be tested carefully. Oracle advises customers to remain on actively supported versions and apply security patches promptly. Patch status for this specific vulnerability is not explicitly confirmed in the advisory; customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and instructions.