This vulnerability affects Oracle Application Development Framework (ADF) in versions 12.2.1.4.0 and 14.1.2.0.0 and is classified as difficult to exploit, requiring a high privileged attacker with logon access to the infrastructure hosting ADF. The vulnerability allows unauthorized access to critical or all data accessible by ADF without impacting data integrity or availability. The CVSS 3.1 vector is AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N, reflecting local attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality impact. Oracle's June 2026 Critical Security Patch Update advisory includes patches addressing this vulnerability among 245 security fixes. Oracle recommends applying these patches without delay to reduce risk.

Successful exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all data accessible by Oracle Application Development Framework (ADF). There is no impact on data integrity or availability. The attack requires high privileges and local access to the infrastructure, making exploitation difficult. The confidentiality impact is high, but integrity and availability impacts are none.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers should apply these security patches promptly to mitigate the risk. Until patches are applied, risk may be reduced by limiting access privileges to only those users who require them and by blocking network protocols required by potential attacks, though these measures may affect application functionality. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory, indicating that fixes are available.