This vulnerability affects Oracle Application Development Framework (ADF) in versions 12.2.1.4.0 and 14.1.2.0.0. It is difficult to exploit and requires a high privileged attacker who already has logon access to the infrastructure hosting ADF. Exploitation can result in unauthorized access to critical or all data accessible via ADF. The CVSS 3.1 vector indicates local attack vector (AV:L), high attack complexity (AC:H), high privileges required (PR:H), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), no integrity or availability impact (I:N, A:N). Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability but does not explicitly confirm a specific patch for it. Oracle advises applying the latest Critical Security Patch Updates to address this and other vulnerabilities.

Successful exploitation of this vulnerability can lead to unauthorized access to critical or all data accessible through Oracle ADF, impacting confidentiality. There is no reported impact on integrity or availability. The attack requires high privileges and local access to the infrastructure, making exploitation difficult. No known exploits in the wild have been reported.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update and any subsequent patches without delay to mitigate this vulnerability. Until patches are applied, risk may be reduced by restricting access to the infrastructure hosting ADF to only trusted high privileged users. Removing unnecessary privileges or access to sensitive packages from users who do not require them may also reduce risk, though this may affect application functionality. No official patch or temporary fix is explicitly confirmed for this CVE in the advisory; therefore, customers should monitor Oracle advisories for updates and apply all relevant security patches promptly.